authentication vulnerabilities