# Auth guard fails open on empty config

Auth helpers that skip verification when keys, roles, or tokens are unset or empty

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-10-02. Updated 2026-10-24._

## How it works
An auth guard treats "no configuration" as "no restriction." The check is written so that when the required secret, role list, or token value is empty or unset, the guard returns success instead of denying. The secure path is never the default, so a fresh install or a shipped example config is wide open. The broken assumption: that an operator will always set the value, and that an empty value means "nothing to enforce" rather than "cannot verify, so refuse."

## Where it shows up
- Auth helper with an early `return`/`pass` when the key or config is missing [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md).
- Token verification nested inside optional role/permission branches, so empty roles skip crypto checks [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj.md).
- Secret compared with strict equality against a default empty string, so an empty header matches [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gp95-j463-vv28.md).
- Shipped `.env.example` with the auth key commented out; Dockerfile without a `USER` directive [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md).
- Read endpoints that never had the auth dependency at all [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md).

## How to review
Find every auth helper and ask: what happens when the config is empty, null, or unset? The invariant that must hold: **absence of configuration must deny, never allow.** Trace each `Depends()`/guard call site and confirm the secure path is the default. Check the shipped example config and installer seed values — is the secret empty by default? For token checks, confirm an empty or absent credential cannot equal the stored default. For guards that split presence-check from verification, confirm verification runs regardless of optional role config [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj.md).

## Variants seen
- Early-return no-op when API key unset, exposing shell execution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md).
- Verification gated behind empty role/permission lists; only presence checked [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj.md).
- Empty default token equals empty supplied header via strict compare [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gp95-j463-vv28.md).

## Impact and severity
Critical: unauthenticated RCE as root [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md), unauthenticated access to protected routes with any Bearer value [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj.md), and anonymous write to FAQ/category data [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gp95-j463-vv28.md). Worse when combined with missing container user isolation [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md) and when read endpoints lack the guard entirely [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-v2f8-6655-7grj.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-qvc3-6q9x-95pj.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-gp95-j463-vv28.md