Reauthentication is a new verification step that asks a user to prove identity again after a sensitive event, such as a password reset, device change, privilege escalation, or unusual activity. It is different from the original login: the system deliberately re-checks trust because the session or account state has changed.
In cyber security, reauthentication matters because attackers often target the moments when trust is refreshed. If a stolen session, compromised helpdesk flow, or risky account change is not followed by reauthentication, an attacker may keep access or bind a new credential without facing another challenge. Strong implementations may require a password, MFA prompt, biometric check, or a step-up challenge before continuing. Defenders use reauthentication to protect recovery workflows, high-risk actions, and administrative changes, and to invalidate or limit access when the account enters a new trust state.