Address OWASP Top 10 A07 Identification and Authentication Failures per OWASP Top 10:2025. Identification and Authentication Failures arise from weak password + session management + credential storage + recovery + reuse attacks + credential stuffing + session fixation + replay attacks. Mitigations include (a) implement strong password requirements aligned to NIST SP 800-63B including compromised password checking + (b) require multi-factor authentication for sensitive operations + privileged accounts + (c) implement secure password storage using adaptive hashing (Argon2 + bcrypt + PBKDF2 + scrypt) + (d) implement credential lifecycle management + (e) implement secure session management including cryptographically random tokens + secure cookies + appropriate timeout + (f) implement rate limiting + account lockout against brute force.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.