# Missing ownership check on device access

Device ID, serial, or user ID used as the only authorization for streams, commands, or account binding

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-07-02. Updated 2026-10-23._

## How it works
An endpoint or protocol message identifies a device by an identifier the caller supplies (deviceId, serial, userid) and treats possession of that identifier as proof of the right to act on the device. The assumption that breaks: that only the owner knows or can obtain the identifier, and that the server compares the identifier in the request against the authenticated principal. When that comparison is absent, the identifier becomes a bearer credential, and identifiers are often guessable, logged, or leaked.

## Where it shows up
- Cloud API endpoints taking deviceId/serial in the body or path with no check against the session's owner [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md)
- P2P or device-messaging commands (e.g. config-set messages) authorized by serial alone [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md)
- Association/binding endpoints with two mirrored flows (user-initiated vs device-initiated) where the branch is chosen by token type only [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking.md)
- Message handlers where the recipient field is normally the sender's own ID, so validation of that field is easy to omit [E3](https://bugbountylibrary.com/r/h1%3A3813932.md)
- Broadcast or Pool targets that skip checks applied to per-user targets [E3](https://bugbountylibrary.com/r/h1%3A3813932.md)
- Legacy desktop clients and debug logs dumping full API traffic and credentials, revealing the identifier format [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md)

## How to review
For every request that names a device or user, find the code that compares that identifier to the authenticated principal's owned set. The invariant: the server must resolve ownership from the session, not from the request body, and reject when the body's userid/deviceid does not match the Session-Id. For dual-flow endpoints, verify the branch selector is not the only gate; both branches must still check ownership [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking.md). For message handlers, confirm the recipient is validated against the sender's own ID or an authorized Pool [E3](https://bugbountylibrary.com/r/h1%3A3813932.md).

## Variants seen
- Cloud API and P2P commands keyed on device serial with no auth at all [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md)
- Session token reused in both Session-Id and sessionidtoken fields to satisfy the wrong flow branch [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking.md)
- Forged self-addressed login messages accepted for arbitrary users and Pools [E3](https://bugbountylibrary.com/r/h1%3A3813932.md)

## Impact and severity
Full stream access, camera control, and device bricking [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md); binding arbitrary devices to an attacker account [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking.md); disconnecting players and blocking online play [E3](https://bugbountylibrary.com/r/h1%3A3813932.md). Severity rises when the identifier is exposed in logs or client traffic and when one identifier unlocks both data and control paths.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking.md
- E3: https://bugbountylibrary.com/r/h1%3A3813932.md