# Misconfiguration in Two Factor Authorisation

Enabling Google Apps SSO on a Shopify store silently disabled 2FA, letting password-only login reach the admin panel and hiding the 2FA settings tab.

- Payout: $1,500
- Severity: high
- Program: Shopify
- Credited: dhaval
- Disclosed: 2016-12-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/178293
- Library page: https://bugbountylibrary.com/r/h1%3A178293
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:sso vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass vuln:misconfiguration

**Target:** Shopify admin authentication / Google Apps login service
**Root cause:** Linking the Google Apps login service overwrote the account's 2FA state, disabling two-factor auth without warning and removing the 2FA configuration tab.
**Steps:**
1. Set up 2FA with Google Authenticator on shop-1.myshopify.com
2. Enable `Google Apps` under Login services at `/admin/settings/account`
3. Sign in via `https://shop-1.myshopify.com/admin/auth/login?google_apps=1` — no 2FA prompt, lands in admin panel
4. Observe 2FA tab is gone from account settings
5. Log in with only username/password at `/admin/auth/login` — admin access granted without 2FA code
**How found:** Researcher enabled Google Apps login service while 2FA was active and noticed the SSO flow skipped the 2FA prompt, then checked settings and found 2FA had been silently disabled.
**Exploitation:** Attacker with stolen credentials convinces/waits for victim to enable Google Apps SSO, or the SSO link itself drops 2FA; thereafter password-only login yields full admin panel access.
**Insight:** When a target supports multiple login services/SSO providers, test whether linking a new identity provider mutates or resets existing MFA state — auth-method transitions are a common place where security controls get dropped.