# authentication-failures

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code. Use when writing login flows, session management, password storage, JWT handling, MFA implementation, credential validation, or any code that authenticates users. Also invoke when implementing "remember me" functionality or API key management.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/authentication-failures ~/.claude/skills/authentication-failures
```

## From README

Authentication Failures Security Check (A07:2025) What this checks Protects identity and session integrity. Weak password storage, flawed JWT handling, and sessions that survive logout let attackers impersonate users, escalate privileges, and persist after credential rotation. Vulnerable patterns JWT verification call with a weak, short, or hardcoded signing secret JWT decode that disables signature verification or accepts the none algorithm Logout handler that does not invalidate the session or token server-side Login flow with no rate limiting or account lockout, allowing credential stuffing Password or API-key comparison using a non-constant-time equality operator For password hashing issues (MD5/SHA), see cryptographic-failures. For hardcoded API keys/passwords in source, see hardcoded-secrets. Fix immediately Flag the vulnerable code and explain the risk.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [contract-review](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/contract-review/index.md) — Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars