# Unauthenticated privileged route exposure

Route groups or RPCs reaching data or mutations with no caller authentication check

_Area: Web access control and IDOR. Seen in 4 disclosed reports; 2 confirmed bounties: $14,000 and $20,000; latest 2026-06-11. Updated 2026-11-07._

## How it works
A route, RPC or handler is mounted on a server that authenticates elsewhere, but this one path reaches data or mutations without any caller check. The broken assumption is that "this endpoint is internal / behind an API key / only our client calls it." An API key, a discovery document, or a sibling route's 401 does not authenticate a caller. When the check is simply absent, anyone who can reach the path acts with the server's full authority.

## Where it shows up
- Route groups mounted without the auth middleware their siblings use (compare 401 vs 500 across groups on the same server) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)
- Internal-looking `*.googleapis.com` admin services gated only by an API key [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai.md)
- RPC methods with no resource ID in the path, bypassing global per-resource authorization middleware [E4](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md)
- Management endpoints that mutate topology or config [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)

## How to review
For every route, ask: which middleware chain is it mounted under, and does that chain actually verify the caller? The invariant: no handler that reads or mutates tenant/user data may be reachable without an authentication check that binds the caller to the resource. Enumerate the full route table and diff auth middleware per group; a group missing what siblings have is the signal. Then trace each unauthenticated handler to its sinks: data reads, state mutations, and fail-fast calls (`Fatalf`, `os.Exit`) reachable from request input [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md). Confirm the check is on the server, not just in the client or an API key.

## How finders spotted it
- Harvested API keys from APKs and web traffic, filtered to Google-owned projects, then mass-scanned discovery docs and probed admin methods for missing access control [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai.md)
- Noticed a route group mounted without OAuth middleware while a sibling group returned 401, then code-read the handler [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)
- Noticed a chat iframe on clients6.google.com, fetched the private discovery doc via a hardcoded key from client JS, then prioritized methods lacking path-based ID middleware [E4](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md)

## Variants seen
- Admin API gated only by API key, exposing PII and number assignment [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai.md)
- Unauthenticated state-mutating DELETE with a nil dereference panic [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)
- Unauthenticated POST reaching `Fatalf`, killing the process [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md)
- Unauthenticated list RPC returning global state across arbitrary time ranges [E4](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md)

## Impact and severity
High to critical. PII plus number assignment chained toward account takeover and possible SIM swap [E1](https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai.md); global support state exposed millions of records [E4](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md); unauthenticated mutation and process kill denied service [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md). Impact rose with breadth (global vs per-tenant), chaining to takeover, and repeatability against arbitrary entries [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E4](https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/free5gc/smf (go)** < 1.4.3, fixed in 1.4.3: free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, (CVE-2026-44328). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md. Fix: https://github.com/free5gc/smf/commit/b57bc48081c3d3a2f333d02eb78e4fd31a120deb
- **github.com/free5gc/smf (go)** <= 1.4.3, no fix yet: free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fa (CVE-2026-44321). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md. Fix: https://github.com/free5gc/smf/commit/e0974e07ddab44a67d36a563cca383b2449e33e5

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md
- E4: https://bugbountylibrary.com/r/blog%3Amichaeldalton-au-posts-hacking-google-support.md