projectdiscovery/nuclei · error

authentication failed

Error message

authentication failed

What it means

telnetmini's login flow (pkg/utils/telnetmini/telnet.go:235) reads post-auth output until one of FailBanners or ShellPrompts matches; if the matched needle equals a FailBanner (case-insensitive, whole-string compare), authentication is declared failed. Default FailBanners are 'login incorrect', 'authentication failed', 'login failed' and default ShellPrompts are '$ ', '# ', '> ' (set by Client.Defaults()). Wrong credentials are the usual cause, but a success path whose prompt never matches can leave a fail banner as the only thing read.

Source

Thrown at pkg/utils/telnetmini/telnet.go:235

	// Wait for password prompt
	if _, _, err := c.readUntil(ctx, c.PasswordPrompts...); err != nil {
		return fmt.Errorf("waiting for password prompt: %w", err)
	}
	if err := c.writeLine(ctx, password); err != nil {
		return fmt.Errorf("sending password: %w", err)
	}

	// Post-auth: look quickly for explicit failure, else accept shell prompt / silence.
	match, got, err := c.readUntil(ctx,
		append(append([]string{}, c.FailBanners...), c.ShellPrompts...)...,
	)
	if err != nil && !errors.Is(err, context.DeadlineExceeded) {
		return fmt.Errorf("post-auth read: %s (got: %s)", preview(got, 200), err)
	}
	low := strings.ToLower(match)
	for _, fb := range c.FailBanners {
		if low == strings.ToLower(fb) {
			return errors.New("authentication failed")
		}
	}
	// success (matched a shell prompt or timed out without explicit failure)
	return nil
}

// Exec sends a command followed by CRLF and returns text captured until one of
// the provided prompts appears (typically your shell prompt). Provide a deadline via ctx.
func (c *Client) Exec(ctx context.Context, command string, until ...string) (string, error) {
	if err := c.writeLine(ctx, command); err != nil {
		return "", err
	}
	_, out, err := c.readUntil(ctx, until...)
	return out, err
}

// --- internals ---

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Verify the credentials the template supplies actually work (manual telnet test)
2. Set ShellPrompts to the device's exact prompt (e.g. 'router# ') so success matches before any fail text
3. Trim or adjust FailBanners if a success message contains a fail phrase
4. Give the login ctx a longer deadline so slow banners are fully read

Example fix

// before
c := telnetmini.New(conn)

// after
c := telnetmini.New(conn)
c.ShellPrompts = []string{"router> ", "router# "}
c.FailBanners = []string{"login incorrect", "authentication failed"}

err := c.Auth(ctx, user, pass)
if err != nil {
    if strings.Contains(err.Error(), "authentication failed") {
        // credential problem: log and skip this target
        return fmt.Errorf("telnet auth rejected for %s", target)
    }
    return err // transport/deadline issue
}

When it happens

Trigger: Calling the auth flow with incorrect username/password; a device printing a failure banner after credentials; ShellPrompts not matching the device's real prompt so only the FailBanner is ever seen; FailBanners containing a phrase that also appears on successful login.

Common situations: Network/tcp templates logging into Cisco/Linux telnet with default or stale credentials; devices with custom PS1 prompts that differ from the '$ ', '# ', '> ' defaults; banner wording differing between device families.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• prompt not found (read cap reached)
• no credentials provided
• could not upload results got status code %v on %v
• failed to send MS-TNAP login packet: %w
• failed to read response: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/7a05fb22e605a1d0. Report an issue: GitHub.