What is credential reuse?¶

Credential reuse is using the same authentication material across more than one account, system or service. It can enable movement after one password or secret is obtained, but repeated usernames or logins do not automatically prove reuse.

Understand the authentication design¶

Two systems may accept one centrally managed identity through federation or single sign-on. Alternatively, similarly named local accounts may have unrelated passwords. Establish whether the evidence describes one shared identity, repeated password material, a token or separate credentials.

Preserve account identifiers, authentication method, password-change history, configuration and sessions without unnecessarily exposing live secrets.

Connect reuse to access¶

Identify where the material was first available, which systems accepted it, whether that use was authorised and what followed. Authentication from the same source after credential access can support the sequence, but personal attribution requires additional evidence.

Users, administrators and services may legitimately share authentication arrangements, while an offender may test a stolen secret broadly. Successful use of the same material establishes a method of access; it does not prove the same person operated every resulting session.