# Unauthenticated state-mutating route

Routes with no credential check that write state, spawn work, or crash into privileged error paths

_Area: Web access control and IDOR. Seen in 3 disclosed reports; latest 2026-05-08. Updated 2026-11-01._

## How it works
A route group is mounted on the server without the authentication middleware its siblings use, so any request that reaches it is treated as trusted. The handler behind it was written assuming an authenticated, well-formed caller: it mutates shared state, dereferences objects that only exist for some inputs, or calls fail-fast logging on bad input. The broken assumption is that "this route is protected like the others." Nothing in the handler enforces it, and nothing in the router makes the omission visible unless you compare route groups side by side.

## Where it shows up
- A route group registered without the auth/OAuth2 middleware that wraps sibling groups on the same server.
- Management or admin APIs (topology, config, node links) that accept JSON and write it into live state.
- Handlers that call `Fatalf`, `os.Exit`, or panic on validation failure of request-supplied data.
- Type guards that wrap only one call, leaving later calls on the same object unguarded.
- Diagnostic endpoints (e.g. ELMAH `elmah.axd`) deployed with no auth, including under nested API prefixes.
- Subdomains that redirect to the main site but still serve paths directly.

## How to review
For every route group, confirm the auth middleware is actually attached, not just present elsewhere in the file. Then, for each unauthenticated handler, trace every request-time path it reaches and ask: does it write state, dereference a possibly-nil field, or call a fail-fast exit? The invariant: an unauthenticated request must not be able to mutate state, crash the process, or reach a sink that assumes validated input. Compare responses across sibling groups (401 vs 500) as a quick signal of a missing guard.

## How finders spotted it
- Noticed the UPI route group mounted without OAuth middleware while a sibling group returned 401, then code-read the delete handler and saw the type guard only wrapped the async release while `CancelAssociation` ran unconditionally on AN nodes built without a UPF [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md).
- Same missing-middleware observation, then traced the create/update handler into `UpNodesFromConfiguration()` and found `Fatalf` call sites reachable from attacker JSON [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md).
- Saw a subdomain redirect to the main site but the admin login page still resolved, then probed common ASP.NET diagnostic endpoints and found `elmah.axd` exposed [E3](https://bugbountylibrary.com/r/h1%3A2891449.md).

## Variants seen
- Nil dereference after a partial type guard, panicking and denying service [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md).
- `Fatalf`/`os.Exit` on validation failure of attacker-controlled JSON, killing the process [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md).
- Diagnostic log endpoint exposing stored requests and session cookies [E3](https://bugbountylibrary.com/r/h1%3A2891449.md).

## Impact and severity
Reached unauthenticated denial of service against core network functions [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md), and full admin session theft leading to account takeover via harvested cookies [E3](https://bugbountylibrary.com/r/h1%3A2891449.md). Impact rose where the missing auth combined with a crash sink [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md) or with logs containing secrets [E3](https://bugbountylibrary.com/r/h1%3A2891449.md); repeatability against arbitrary entries widened it [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9mg-74mg-cwwr.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97.md
- E3: https://bugbountylibrary.com/r/h1%3A2891449.md