Security Assessment of PIN-Based Authentication Mechanisms in Web Applications: A Penetration Testing Case Study of a Healthcare Platform in Nigeria

Abstract

Healthcare web applications process sensitive operational and personal information, making secure authentication essential. This paper presents an authorized penetration-testing case study of the PIN-based administrator authentication mechanism in the development environment of MySmartMedic PHC Edition, drawing on evidence documented in an industrial training report. The assessment used controlled testing and evidence-based vulnerability reporting to examine the administrator login workflow, resistance to repeated PIN-verification attempts, and authentication token handling. The documented findings identified ineffective rate limiting and weak PIN complexity requirements. The report also recorded that successful verification using a weak PIN resulted in the application returning a valid bearer token. Together, weak PIN requirements and insufficient attempt controls could facilitate unauthorized access to an authenticated session if the reported conditions were reproducible in the assessed environment. These findings highlight the importance of layered authentication controls, server-side attempt throttling, secure token issuance and handling, and systematic security testing throughout the software development lifecycle. The case provides context-specific evidence to inform authentication security assessment in healthcare applications. Because the source material is an industrial training report rather than a controlled experiment, the findings do not establish vulnerability prevalence or statistical generalizability.