# Auth check fails open on malformed input

Authorization or filtering logic that allows access when input is empty, missing, or unparsable

_Area: Web access control and IDOR. Seen in 5 disclosed reports; latest 2026-09-24. Updated 2026-10-24._

## How it works
An access-control decision is computed from a value that may be absent, empty, or in an unexpected shape. Instead of denying when it cannot evaluate, the code takes a branch that skips the check or treats "unknown" as "allowed." The control looks present in review but is unreachable or bypassed for the inputs an attacker controls.

## Where it shows up
- A security gate keyed on a config field; trace every assignment site to confirm it can actually be set [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)
- A guard like `if x != nil { check }` where a nil/empty x silently returns the record unchecked [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md)
- Mitigation logic that depends on a client-supplied header (e.g. Content-Length) to detect a server-side condition [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md)
- Filtering that inspects only one field (first cell, primary key) while denormalized mirrors carry foreign content [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md)
- Comments claiming enforcement backed by a branch that never executes [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)

## How to review
For each authorization/filter decision, identify the exact input it depends on and ask: what happens when that input is empty, missing, or of an unexpected type? The invariant: **the default on any unparsable or absent input must be deny/skip, never allow.**
- Prove the config value the control is gated on is reachable from a real assignment site [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)
- Check that alternate request framings (chunked, HTTP/2, no Content-Length) still trigger the mitigation [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md)
- Confirm the filter evaluates every field that can carry foreign content, not just the primary one [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md)
- Verify the guard's else/nil path denies rather than returns unchecked [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md)

## Variants seen
- Dead config gate: read-only backstop gated on a field the schema forbids, leaving only a weak keyword classifier [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md)
- Header-dependent truncation detection that fails open on chunked/HTTP-2 bodies [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md)
- Publish filter checking only the first cell, skipping the check when it is not a block, and ignoring Relation/Rollup mirrors [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md)

## Why fixes fail
E2 is an incomplete fix: the prior mitigation's positive-control test only exercised small chunked bodies, so the fail-open on oversized chunked/HTTP-2 requests survived [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md).

## Impact and severity
Led to database writes and RCE despite read-only mode [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md), un-inspected oversized bodies reaching upstream past body-authz [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md), and leakage of hidden-database content [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md). Severity rises when the bypass is the sole backstop or when alternate framings are untested.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-mwwr-p57h-56pf.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-5gpm-rgj3-9q76.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-mfrj-v65r-979c.md