Glossary
Credential Stuffing
Credential stuffing takes username and password pairs exposed in one service's breach and tries them, automated and at scale, against many other, unrelated services — relying entirely on the fact that people reuse the same password across multiple accounts. No vulnerability in the targeted service is required; the attack succeeds purely on the strength of reused credentials elsewhere.
Because the attack doesn't depend on breaking any single service's defenses, defending against it falls mostly on things that don't require a password to be unique or strong in the first place: rate limiting login attempts, detecting the traffic pattern automated stuffing produces, and requiring a second factor that a leaked password alone can't satisfy.