The login endpoint anyone can brute force
Broken Authentication

The attacker finds the login endpoint from a mobile app or SPA bundle — /api/auth/login, JSON in, JWT out.

1. 1
   Dump a wordlist

   They grab the top 10,000 passwords from a breach corpus and run them against a list of emails scraped from a public leak. No rate limiting, so all 10,000 requests per account go through.
2. 2
   Crack a token

   They sign up legitimately, grab their JWT, and check the algorithm. HS256 with a six-character secret copied from a Stack Overflow answer. Offline dictionary attack finds it in under a minute.
3. 3
   Forge anyone

   Now they can mint a token for any user_id they want. The server happily accepts it because the signing key is the same for every user and the expiration is two weeks out.
4. 4
   Persist

   Even after the real user changes their password, the attacker's forged token still validates. Nothing rotates the key, nothing tracks token version, nothing logs out the other session.

The attacker has a permanent backdoor into every account on the platform — not because they broke crypto, but because the auth system was built as a shape, not as a lifecycle.

// app/api/auth/login/route.ts
import jwt from 'jsonwebtoken';

const JWT_SECRET = 'supersecret'; // hardcoded, short, copied from a tutorial

export async function POST(req) {
  const { email, password } = await req.json();

  const user = await db.user.findUnique({ where: { email } });
  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
    return Response.json({ error: 'Invalid credentials' }, { status: 401 });
  }

  // 30-day token. No jti. No refresh. No revocation.
  const token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: '30d' });
  return Response.json({ token });
}

// app/api/auth/login/route.ts
import jwt from 'jsonwebtoken';
import { rateLimit } from '~/lib/rate-limit';

const JWT_SECRET = process.env.JWT_SECRET!; // 256-bit, server-side only

export async function POST(req) {
  const ip = req.headers.get('x-forwarded-for') ?? 'unknown';
  const { email, password } = await req.json();

  const ok = await rateLimit(`login:${ip}:${email}`, { max: 5, window: '15m' });
  if (!ok) return Response.json({ error: 'Too many attempts' }, { status: 429 });

  const user = await db.user.findUnique({ where: { email } });
  if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
    return Response.json({ error: 'Invalid credentials' }, { status: 401 });
  }

  const token = jwt.sign(
    { sub: user.id, tokenVersion: user.tokenVersion },
    JWT_SECRET,
    { expiresIn: '15m', algorithm: 'HS256' },
  );
  return Response.json({ token });
}

Three cheap changes: a per-IP-per-email rate limit stops brute force, a real secret out of env stops forgery, and a token version in the claims lets you bump it on password change and invalidate every old session at once. The refresh flow (not shown) lives behind a cookie with stricter controls.