# Auth state not reset on rekey or reconnect

Rekey, retransmit or reconnect paths that reinstall keys or skip auth checks and leave a session trusted

_Area: Network devices and IoT. Seen in 2 disclosed reports; latest 2026-09-17. Updated 2026-11-01._

## How it works
A session is authenticated once. A later event — a rekey, a retransmitted setup message, a reconnect — moves the connection through a state transition. The code assumes that transition only happens on an already-trusted session, so it skips re-checking auth or re-installs key material. When an attacker can trigger that transition, the session is treated as authenticated without ever proving it, or a key/nonce counter is reset and reused.

## Where it shows up
- Handshake retransmission handlers that reinstall a session key instead of rejecting a replay [E1](https://bugbountylibrary.com/r/h1%3A286740.md)
- Rekey or reconnect code paths that jump past the auth-state check into a dispatcher [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md)
- Nonce/counter state that is reset on key reinstall rather than preserved [E1](https://bugbountylibrary.com/r/h1%3A286740.md)
- Legacy local-only interfaces (fd-selector args, dash-prefixed params) reachable from network input after an auth-state desync [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md)

## How to review
Find every state transition after initial auth (rekey, retransmit, reconnect, renegotiation) and ask: does this path re-verify auth, and does it preserve counters? The invariant: a transition must never grant trust or reset a nonce unless the peer has proven identity on that transition. Check that replayed setup messages are rejected, not reprocessed. Check that a rekey path re-enters the auth check before reaching the dispatcher. Separately, when a state desync can expose a privileged helper, check that network-reachable login code rejects leading-dash/fd-selector parameters [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md).

## How finders spotted it
- Observed that a retransmitted handshake message 3 caused clients to reinstall the session key, resetting the nonce counter and enabling nonce reuse [E1](https://bugbountylibrary.com/r/h1%3A286740.md)
- Compared vulnerable vs fixed releases, traced changes through the SSH service and login process, and picked the advisory path with fewest prerequisites; patch diffing revealed the missing policy check in the dispatcher [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md)

## Variants seen
- WPA2 4-way handshake: retransmitted message 3 reinstalls the PTK, resetting the transmit nonce [E1](https://bugbountylibrary.com/r/h1%3A286740.md)
- RouterOS SSH: rekey moves an unauthenticated connection past the auth check into the dispatcher [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md)

## Impact and severity
E1 enabled keystream reuse to decrypt traffic, extended by known plaintext from predictable packets (ARP, DHCP, HTML) [E1](https://bugbountylibrary.com/r/h1%3A286740.md). E2 gave full admin on routers: the rekey bypass crossed a trust boundary to reach the login helper, where a second weakness (fd-injection) converted it into a trusted admin identity, then persistence via a scheduled script [E2](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md). Impact rises when the bypass crosses into a privileged helper or combines with a second weakness.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A286740.md
- E2: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-mikrotrick-inside-the-routeros-takeover-chain.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-macos-screen-sharing-rce-patched.md