---
name: web-authentication-and-account-takeover
description: "Guides a reviewer through mapping authentication and account-takeover surfaces and applying the pattern index to find broken user boundaries on an authorized target."
---

# Web authentication and account takeover

Login, sessions, password reset, MFA, OAuth, SAML, SSO and tokens: every way a user boundary breaks down.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 17 newer reports it was not written from: following it finds about 21% of them._

## Approaching Web Auth & Account Takeover

**Goal:** find where the user boundary breaks — not just whether login works, but whether identity, session, and recovery stay bound to the right person on every path.

**Map first:**
1. Every entry point that mints or accepts identity: login, register, setup, OAuth/SAML callbacks, SSO handoff, password reset, email change, MFA enroll/verify, token refresh, invite/link flows.
2. For each, note: what credential arrives, what the server checks, what it trusts, and what object/user it binds to.
3. Session model: cookie flags, signing key source, scope (domain/path), lifetime, invalidation on reset.

**Questions that surface weaknesses:**
- Is the token/code/claim bound server-side to *this* user and object at redemption, or just present?
- Is every email-keyed link gated on a *verified* email?
- Does the second factor apply to *every* path that performs the sensitive action, or just the main one?
- Do the validator and the consumer parse the same input the same way?
- Are redirects, state, and redirect_uri checked by exact match after normalization?
- Can a request shape (method, suffix, re-execution) skip the auth check?
- Are reset/OTP tokens unpredictable, single-use, atomically throttled, and bound to the account?
- Are secrets static, default, or leaked into URLs, logs, telemetry, or user objects?

**Using the patterns below:** treat each as a hypothesis to test against your map. Walk the list against every entry point — most real findings are a pattern applied to a path the developer forgot. Prioritize flows that cross a trust boundary (callback, handoff, reset, linking) and any place a client-supplied value reaches a privileged sink. Confirm binding and verification server-side; never assume the happy path is the only path.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### CSRF on cookie-authenticated write endpoints
State-changing endpoints trusting ambient cookies without a token, Origin check, or preflight barrier

_18 reports · 11 confirmed bounties, median $2,400, up to $6,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/csrf-missing-token-state-change.md

### Unbound token claims enable impersonation
Is the token, code, or identity claim bound server-side to the target user or object at redemption?

_13 reports · 9 confirmed bounties, median $6,250, up to $100,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/token-claim-not-bound.md

### Unverified email account linking takeover
Does every email-keyed link, invite, or OAuth grant require a verified email server-side?

_12 reports · 6 confirmed bounties, median $3,000, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/email-verification-bypass.md

### Unverified signature and token trust
Auth decisions that accept a signature, key, or token claim without verifying it

_11 reports · 6 confirmed bounties, median $1,385, up to $12,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-bypass-via-trusting-unverified-identity.md

### Open redirect leaking auth tokens
Redirect params carrying codes or tokens checked by prefix, suffix, case, or not at all

_10 reports · 7 confirmed bounties, median $2,450, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/open-redirect-token-leak.md

### MFA bypass via alternate endpoint or flag
Second factor enforced per-endpoint or trusted from client flags; check every path that performs the sensitive action

_9 reports · 7 confirmed bounties, median $1,000, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/mfa-bypass-alternate-path.md

### OTP and reset brute force via weak throttling
Short OTP or reset code guarded only by per-IP or non-atomic throttling, guessable concurrently

_8 reports · 6 confirmed bounties, median $10,000, up to $30,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/otp-brute-force-rate-limit.md

### OAuth state and callback CSRF binding
Callback trusts state that is unbound, forgeable, leaked, or truncated, binding attacker tokens to victim sessions

_7 reports · 5 confirmed bounties, median $1,600, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/oauth-state-csrf-binding.md

### SAML assertion signature verification bypass
Assertion trusted without signature check, or verifier and attribute parser disagree on XML structure

_6 reports · 6 confirmed bounties, median $5,750, up to $10,500._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/saml-signature-verification-bypass.md

### OAuth redirect_uri validation bypass
Redirect_uri checked by prefix, host, or regex before normalization, leaking codes or tokens

_6 reports · 5 confirmed bounties, median $4,000, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/oauth-redirect-uri-validation-bypass.md

### CSRF token leak via referer or href
Anti-CSRF token sent to attacker-controlled origin or leaked in Referer to third parties

_6 reports · 5 confirmed bounties, median $7,500, up to $15,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/csrf-token-leak-referer.md

### Alternate endpoint skips auth check
A second route performs the same sensitive action without the primary flow's auth or re-auth gate

_6 reports · 3 confirmed bounties, median $1,000, up to $50,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/alternate-endpoint-skips-auth-check.md

### Hardcoded signing and cookie secrets
Static or default keys signing sessions, tokens, or reset links, letting anyone forge identities

_5 reports · 3 confirmed bounties, median $90,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/hardcoded-signing-secrets.md

### Email normalization and truncation mismatch
Validation, storage and lookup see different versions of the same email string

_5 reports · 2 confirmed bounties: $500 and $1,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/email-normalization-truncation.md

### JWT algorithm and claim confusion
Verifier accepts unpinned algorithms or skips issuer, tenant, or audience checks, so forged or cross-tenant tokens pass

_5 reports · 2 confirmed bounties: $1,337 and $40,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/jwt-algorithm-claim-confusion.md

### Auth check skipped by request shape
Privileged handler reachable via method alias, path suffix, internal re-execution, or sibling step that skips its auth check

_5 reports · one confirmed bounty: $25,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-check-skip-route-method.md

### Skipped TLS peer and session trust checks
Conditional hostname checks, unbound OCSP responses, session reuse after failed verification, dual chain builders

_5 reports · 2 confirmed bounties: $300 and $2,580._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/tls-cert-validation-skip.md

### Unauthenticated setup and registration endpoints
Setup, install, register, or agent endpoints reachable without auth that mint admin sessions or dump credentials

_5 reports · 2 confirmed bounties: $1,000 and $1,200._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/unauthenticated-setup-endpoint.md

### OAuth redirect URI validation bypass
Redirect target validated as raw string before browser normalization, or on error paths, leaking codes

_5 reports · 3 confirmed bounties, median $1,000, up to $7,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/oauth-redirect-uri-validation-bypass-2.md

### Predictable reset and verification tokens
Reset/verify tokens from weak PRNG, UUIDv1, short codes, or loose validation that can be guessed or reused

_4 reports · 2 confirmed bounties: $5,000 and $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/weak-predictable-reset-tokens.md

### Reset token not bound to account
Password reset trusts client-supplied email or account id not bound to the token

_4 reports · 2 confirmed bounties: $4,000 and $6,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/reset-token-not-bound.md

### Session cookie forgery and scope
Weak or leaked signing keys, cookies not bound to subdomain, IP, or device, stale sessions surviving reset

_4 reports · 4 confirmed bounties, median $1,090, up to $13,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/session-cookie-forgery.md

### Auth parser differential trust bypass
Same bytes parsed twice by check and consumer that disagree on duplicates, namespaces, or encoding

_4 reports · 2 confirmed bounties: $1,000 and $2,500._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/parser-differential-auth.md

### SSRF forwarding auth to attacker hosts
Proxy or URL fetch that attaches auth headers and builds the target host from client-controlled input

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/ssrf-auth-header-forward.md

### postMessage origin not validated
postMessage handlers or token relays that skip origin checks or take target origin from request params

_4 reports · 3 confirmed bounties, median $1,200, up to $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/postmessage-origin-unchecked.md

### Reflected and leaked credentials enabling takeover
Verification codes, passwords, or tokens echoed into logs, tickets, emails, or replies reachable by an attacker

_4 reports · one confirmed bounty: $3,134._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-bypass-via-leaked-credentials.md

### Auth tokens leaked in API responses
Credential or token fields serialized to a different principal, or a token whose real scope exceeds its label

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/token-exposure-in-response-or-email.md

### OAuth email claim trusted without verification
Login authorizes on OAuth/OIDC email or domain claim without checking email_verified or org membership

_4 reports · 2 confirmed bounties: $1,000 and $1,337._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/unverified-oauth-email-claim-trust.md

### Throttle key bypass via input variation
Rate limits keyed on raw email, spoofable IP headers, or array params that vary per account

_4 reports · 2 confirmed bounties: $480 and $3,500._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/throttle-key-bypass.md

### Secrets leaked to telemetry and URLs
Reset or session tokens in query strings, analytics payloads, or API user objects without redaction

_3 reports · 2 confirmed bounties: $200 and $200._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/token-in-url-telemetry-leak.md

### Cookie prefix and parsing bypass
Cookie name/value decoding, Unicode trimming, or legacy $Version parsing that lets subdomains forge __Host-/__Secure- cookies

_3 reports · one confirmed bounty: $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/cookie-prefix-parsing-bypass.md

### Default credentials on admin surface
Shipped or provisioned default passwords, alternate auth endpoints, and admin panels left reachable

_3 reports · one confirmed bounty: $7,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/default-credentials-admin-panel.md

### Mass assignment of trusted flags
User-supplied params setting trusted, verified, role, or recovery fields on non-admin endpoints

_3 reports · one confirmed bounty: $5,580._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/mass-assignment-trust-flag.md

### Password reset and email change without re-authentication
State-changing reset or email-change routes that act on an email or session without verifying old password or token

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/reset-flow-skips-reauth.md

### Nil-accepted token validation bypass
Auth that parses credentials into nil/empty and then matches unset DB columns or skips token checks

_3 reports · 2 confirmed bounties: $100 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/token-validation-swallowed-errors.md

### SSO handoff missing scope recheck
Handoff endpoints that mint sessions or tokens without rechecking role, scope, or expiry

_3 reports · one confirmed bounty: $200._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-bypass-via-scope-and-role-mismatch.md

### Unsanitized URL/ref to privileged sink
User-controlled URL, ref, or path reaching shell, git, or loader without validation or separator

_3 reports · one confirmed bounty: $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-bypass-via-unsanitized-url-or-ref.md

### Auth code and token replay
Exchange handlers that never consume the code or check the code's own expiry, allowing replay

_2 reports · 2 confirmed bounties: $300 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-authentication-and-account-takeover/auth-code-and-token-replay.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Account creation without email ownership proof**: Signup or invite flow creates account and grants access before any email verification step (https://bugbountylibrary.com/r/h1%3A1534465.md)
- **CSRF via missing header and referrer leak**: State-changing endpoints relying on SameSite or Sec-Fetch-Site that cross-site navigation can omit (https://bugbountylibrary.com/r/h1%3A3253725.md)
- **Email field type confusion in reset and activation**: Email fields accepting arrays or delimiters, or normalization before validation, in reset and activation flows (https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md)
- **Exposed portal with weak auth**: Remote-access or admin portal with default/weak passwords and no MFA enforcement (https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-terminal-server-phishing-stager-exposed.md)
- **Reusable SSO ticket chained with XSS**: SSO tickets accepted more than once and reflected XSS on login pages enabling account takeover (https://bugbountylibrary.com/r/h1%3A265943.md)
- **Session cookie reusable without device binding**: Session cookies accepted from any client with no device, IP, or rotation binding (https://bugbountylibrary.com/r/h1%3A745324.md)
- **Validation errors swallowed accepting bad tokens**: Auth handlers that catch and ignore validation errors, accepting malformed or garbage tokens (https://bugbountylibrary.com/r/blog%3Awiz-io-blog-off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise.md)