# Navigating Lax Load Balancers: When an Intersection Gets You Inside

ALB listener rule priority ordering lets a broad path /* rule shadow a later authenticate-oidc rule on /admin*, bypassing authentication entirely.

- Payout: Research
- Severity: high
- Program: Amazon
- Write-up by: Doyensec
- Disclosed: 2026-05-24
- Write-up quality: 6/10
- Original: https://blog.doyensec.com/2026/05/25/cloudsectidbits-elbaph-alb.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-25-cloudsectidbits-elbaph-alb-html
- Tags: area:cloud domain:cloud impact:internal-access kind:research platform:research sev:high tech:aws vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** Application Load Balancer listener rules
**Root cause:** ALB listener rules evaluate in ascending priority order; a broad rule at priority 10 matches /admin before the restrictive authenticate-oidc rule at priority 20, so the auth action never fires.
**Steps:**
1. Configure ALB listener with rule [10] path /* → forward → tg-app (no auth)
2. Add rule [20] path /admin* → authenticate-oidc → tg-app
3. Send request to /admin; it matches rule 10 first and is forwarded unauthenticated
4. The authenticate-oidc action on rule 20 is never reached
**How found:** Reviewing listener rules in priority order and asking whether a broader lower-priority-number rule matches the same traffic before a restrictive auth rule fires.
**Exploitation:** Attacker requests /admin directly; the broad priority-10 rule forwards to the same target group without triggering authenticate-oidc, granting unauthenticated access to the protected path.
**Insight:** Treat ALB listener rule priority like middleware ordering: for every authenticate-oidc or source-ip rule, check whether a lower-numbered broader rule (e.g. path /*) matches the same traffic first and forwards to the same target group.

## Proof of concept (copied exactly from the original report)

**Rule shadowing priority ordering example**

```
(priority) (condition) (action)

[10] path /* → forward → tg-app (no auth)
[20] path /admin* → authenticate-oidc → tg-app (← never reached for /admin)
```

**Source-ip gate bypass rule example**

```
(priority) (condition) (action)

[10] source-ip 1.2.3.4/32 → forward → tg-internal-api
[default] → 403
```

**ELBaph scan commands**

```
# Scan a region - findings printed live, output folder created automatically
elbaph scan --region us-east-1

# Scan multiple regions using an AWS profile
elbaph scan --all-regions -p my-pentest-profile
```