Authentication, Session Management, and Access Control Flaws
Separate identity from permission
Authentication asks who you are; authorization asks what you may do. Most misses are on the second question.
Authentication flaws worth memorizing: PHP loose comparison against hashes (== with magic hashes like 0e...), type juggling where strcmp returns null, password reset tokens that are predictable (timestamp, md5 of email, sequential IDs), tokens leaked in responses or the Referer header, host-header poisoning of reset links, username enumeration through messages or timing, and multi-step MFA that can be skipped by calling the post-MFA endpoint directly.
Session management: check whether the session ID rotates at login (fixation if not), whether cookies carry Secure, HttpOnly, and SameSite, whether tokens ride in URLs, and whether identifiers derive from predictable values. For JWTs, test alg: none, offline cracking of weak HS256 secrets, kid values that reach a filesystem or SQL query, and jku/x5u headers pointing at attacker-controlled key sets.
Access control: build a matrix of endpoints times roles times HTTP methods, and try each cell with a low-privileged session and with no session at all. Look for missing function-level checks (the UI hides a button; the API does not check), IDOR where an object ID is trusted without an ownership query, and mass assignment where role or isAdmin binds straight from a JSON body.
Traps: a random-looking UUID is not an authorization control once it leaks; HttpOnly does not stop CSRF; SameSite=Lax still permits top-level GET navigation; and a 200 with different content is as interesting as a 403 bypass.
Rule of thumb: for every object reference, ask whether the server verified ownership or merely existence.