authentication vulnerability