Stop 8 of 42 · The ID Desk · Weak login checks

An ID desk that gives too much away

At the ID desk, Mallory asks about customers by name. For one name the clerk says “no such customer”, for another “wrong PIN”. Now she knows exactly who to target. Then she tries the classic master code, admin and admin, and the clerk waves her through.

Severity Medium to CriticalCategory Auth WeaknessThe ID DeskSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory learns which customers exist from the clerk’s different answers, then gets in with the default admin code.

Arrival

Alice and Mallory both walk up to the bank. Everyone has to stop at the ID desk first.

1 / 5

In bank terms and app terms

In the bankIn your app
ID deskYour login endpoint
“No such customer” vs “wrong PIN”Different error messages, status codes or response times for unknown vs known emails
Default master codeSeeded admin@admin.com / admin, test accounts or demo passwords left in production
Same answer every timeOne generic message such as “Invalid email or password”

Are you exposed?

You might be exposed if…
  • Your login says “user not found” for some emails and “wrong password” for others.
  • You seeded an admin or test user (admin, test, demo) and never removed or changed it.
  • Failed logins return differently shaped responses, or take noticeably longer for real accounts.
What to do about it
  1. Return one generic message and status for every failed login, and keep response times similar.
  2. Delete seeded and default accounts before launch, and force strong passwords for admins.
  3. Add rate limits and lockouts so robbers cannot keep guessing (see Missing rate limits).

Track these in your to-do list →

It has happened to real companies

Real-world breaches

iCloud (2014) — The authors of a tool called iBrute claimed it used Apple's Find My iPhone API to guess passwords because the API lacked brute-force countermeasures. After the celebrity photo leaks, Apple said the accounts were compromised by a very targeted attack on user names, passwords and security questions, and not by a breach of its systems, including iCloud or Find My iPhone. It was never confirmed that iBrute was used in those leaks, but unlimited password guessing is exactly what an account-lockout check is meant to catch.

What it looks like in code

// GOOD: Same error message for all auth failures
if (!user || !validPassword) {
  return NextResponse.json(
    { error: "Invalid email or password" },  // Same message regardless of cause
    { status: 401 }
  )
}

// GOOD: Account lockout after N attempts
const attempts = await getLoginAttempts(email)
if (attempts >= 5) {
  return NextResponse.json({ error: "Too many attempts. Try again later." }, { status: 429 })
}

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Audit my login and signup routes for weak authentication. Make every failed login return the same generic message and status code whether the email exists or not. Remove any seeded default users such as admin/admin or test/test, and make sure admin passwords come from environment variables. List what you changed.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.