# Empty or stale credential auth bypass

Auth handlers that accept empty passwords or stale success returns as authenticated

_Area: Network devices and IoT. Seen in 2 disclosed reports; latest 2026-08-07. Updated 2026-10-24._

## How it works
An authentication handler decides "authenticated" from a value that is absent, empty, or left over from an earlier check, rather than from a positive verification of the presented credential. Two shapes: (1) a guard that only installs the password check when the password is non-empty, so an empty password means no check is installed and the library falls back to no-auth; (2) a validator that returns a cached/stale success status, so a failed or skipped check is read as a pass. In both, the assumption "a check ran and passed" is false, but the code path treats it as true.

## Where it shows up
- Handler installation guarded by `username != "" && password != ""` or similar; empty operand skips the handler entirely.
- Auth libraries that set `NoClientAuth`/anonymous mode when no handler is registered.
- Length/state validators returning a prior success value instead of a fresh result.
- Privileged components (PAM, SUID, daemons) reading identity or socket paths from environment variables.
- Config or CLI flags that can leave a credential field empty (`-b 'admin:'`).

## How to review
Check the invariant: authentication succeeds only if a verification function ran and returned success for this request. Trace every path where a handler can be nil, skipped, or short-circuited, and confirm the default is deny, not allow. For validators, confirm the return value is computed for the current input, not carried over. For privileged code, confirm identity/paths derive from the authenticated account's session, not the caller's environment. Enumerate both operands of any `&&`/`||` guard.

## Variants seen
- Empty password skips PasswordHandler; no PublicKeyHandler set, so library enables NoClientAuth [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjrw-mjq6-hpmm.md).
- Stale success from a frame-length validator marks session authenticated, then runs cleartext [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-macos-screen-sharing-rce-patched.md).
- Env-controlled `SSH_AUTH_SOCK` lets sudo's PAM stack use another user's agent, bypassing socket permissions [E3](https://bugbountylibrary.com/r/h1%3A204802.md).

## Why fixes fail
E2: prior CVE fix added only a `HasPrefix(":")` check for empty usernames; the faulty `&&` condition remained, leaving the empty-password operand exploitable [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjrw-mjq6-hpmm.md).

## Impact and severity
Unauthenticated file read/write/delete [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rjrw-mjq6-hpmm.md); root-level arbitrary file access over the network [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-macos-screen-sharing-rce-patched.md); local privilege escalation via sudo [E3](https://bugbountylibrary.com/r/h1%3A204802.md). Severity is high because the bypass is pre-auth and needs no credential; worse when the resulting session is cleartext or runs as root.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-macos-screen-sharing-rce-patched.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-rjrw-mjq6-hpmm.md
- E3: https://bugbountylibrary.com/r/h1%3A204802.md