Authentication Bypass

Description

Such mistakes often appear where an application grows faster than its security model. One part of the system checks the user, another assumes the check has already been done, a third has an old route that was never switched off. The attacker does not break down the door; they find a corridor nobody is watching.

The consequence can be access to a user account, to administration, to internal data, or to a function that changes the state of the system. Authentication therefore has to be centralized, consistent, and checked at every place where a decision has consequences.

Examples

• An administrator page is reachable by typing the URL directly, because the protection exists only in the application's menu.
• The attacker skips the second step of the login by calling directly the endpoint expected only after MFA confirmation.
• A password reset token is predictable or valid for too long, so the attacker can take the account over even with the old password still in place.

Notes

• A hidden page is not a protected page. If a route exists, it has to check identity and access rights.
• MFA does not help if the application has an alternative path that never checks that MFA at all.