# Pre-auth file read exposing secrets

Unauthenticated endpoints that read files or expose credentials, certs, or session stores

_Area: Network devices and IoT. Seen in 4 disclosed reports; 2 confirmed bounties: $20,160 and $107,500; latest 2025-07-27. Updated 2026-10-23._

## How it works
An endpoint reachable before login reads a file or returns identifiers that function as credentials. The broken assumption is that "only trusted callers reach this code" or "these values are not secret." When the read path is unauthenticated, anything stored in those files or returned by that API becomes attacker-controlled input to authentication.

## Where it shows up
- File-serving or proxy endpoints (traversal-prone paths, static handlers) reachable pre-auth.
- Credential/session caches on disk: lmdb stores, plaintext password caches, 2FA/session tokens [E2](https://bugbountylibrary.com/r/h1%3A591295.md)[E3](https://bugbountylibrary.com/r/h1%3A695005.md).
- Local device APIs returning certs, cloud IDs, or device names that the cloud treats as proof of identity [E1](https://bugbountylibrary.com/r/blog%3Adownrightnifty-me-blog-2022-12-26-hacking-google-home-html.md).
- Setup/onboarding flows that expose linking material over open or forced APs [E1](https://bugbountylibrary.com/r/blog%3Adownrightnifty-me-blog-2022-12-26-hacking-google-home-html.md).
- Edge appliances lagging vendor patches; check version against advisories [E2](https://bugbountylibrary.com/r/h1%3A591295.md).

## How to review
Trace every pre-auth route to what it can read or return. The invariant: no unauthenticated request may read a file outside a fixed public set, and no value returned pre-auth may be accepted as a credential by any backend. Check that session/credential caches are encrypted or not readable via the same path, and that device-linking requires a secret not exposed locally. Confirm patch level on VPN/firewall firmware.

## Variants seen
- Path traversal in a web endpoint reading arbitrary files, then harvesting cached plaintext creds [E3](https://bugbountylibrary.com/r/h1%3A695005.md).
- Known CVE file-read pulling lmdb stores with plaintext passwords and reusable sessions, bypassing 2FA [E2](https://bugbountylibrary.com/r/h1%3A591295.md).
- Local API exposing cert + cloud ID that the cloud accepts to link an attacker account [E1](https://bugbountylibrary.com/r/blog%3Adownrightnifty-me-blog-2022-12-26-hacking-google-home-html.md).

## Why fixes fail
Patch lag: the same class persisted on edge appliances over a month after advisory, and the read was chained to a separate post-auth command injection for full compromise [E2](https://bugbountylibrary.com/r/h1%3A591295.md)[E3](https://bugbountylibrary.com/r/h1%3A695005.md). Fixing the read alone leaves cached plaintext secrets exploitable if any other read path exists.

## Impact and severity
Critical: pre-auth read converted to auth bypass, 2FA bypass, and RCE [E2](https://bugbountylibrary.com/r/h1%3A591295.md)[E3](https://bugbountylibrary.com/r/h1%3A695005.md); account takeover and mic wiretap on IoT [E1](https://bugbountylibrary.com/r/blog%3Adownrightnifty-me-blog-2022-12-26-hacking-google-home-html.md). Worse when secrets are cached in plaintext and when a second flaw (command injection) is present.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Adownrightnifty-me-blog-2022-12-26-hacking-google-home-html.md
- E2: https://bugbountylibrary.com/r/h1%3A591295.md
- E3: https://bugbountylibrary.com/r/h1%3A695005.md