# Alternate endpoint skips auth check

A second route performs the same sensitive action without the primary flow's auth or re-auth gate

_Area: Web authentication and account takeover. Seen in 6 disclosed reports; 3 confirmed bounties, median $1,000, range $250-$50,000; latest 2025-10-12. Updated 2026-10-23._

## How it works
A sensitive action (password reset, app-password creation, 2FA rebind, file write, API access) is protected in one place — a controller, a UI flow, a middleware, or a line mid-file. The assumption that breaks is that this one check covers the action everywhere. Any other route, file, or API that reaches the same primitive runs without the check, so the protection is only as strong as its weakest entry point.

## Where it shows up
- Auth checks placed mid-file rather than at entry, so earlier code runs unauthenticated [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md)
- Client-side router tables listing privileged paths (reset/forgot/admin) that can be hit directly [E5](https://bugbountylibrary.com/r/blog%3Ahealdb-tech-blog-teradici-html.md)
- Legacy/OCS/alternate API routes duplicating a gated controller action [E6](https://bugbountylibrary.com/r/h1%3A2067572.md)
- Endpoints keyed by user id that overwrite security state (e.g. 2FA secret) without auth [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-clubwpt-gold.md)
- Reverse-proxy or routing rules that intermittently or partially enforce authorization [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md)
- Sibling enforcement paths (REST, GraphQL, Git) after a fix to one path [E4](https://bugbountylibrary.com/r/h1%3A1285226.md)

## How to review
Enumerate every route that performs the sensitive action, not just the documented one. For each, confirm the auth/re-auth check runs before any side effect, at the entry point, and is enforced server-side. The invariant: for a given action, all entry points require the same authorization and freshness (re-auth) checks, and no code executes before the check. Grep router configs and controllers for the action's primitives (password set, token/app-password issue, secret bind, file write) and trace each to its gate.

## Variants seen
- Code before an in-file admin check executes unauthenticated [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md)
- Unauthenticated 2FA rebind by uid plus leaked secrets [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-clubwpt-gold.md)
- Intermittent authorization failure on a large API surface [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md)
- Regression re-opening a previously patched path [E4](https://bugbountylibrary.com/r/h1%3A1285226.md)
- Hidden client-side route to admin password reset [E5](https://bugbountylibrary.com/r/blog%3Ahealdb-tech-blog-teradici-html.md)
- Alternate OCS route bypassing password-confirmation gate [E6](https://bugbountylibrary.com/r/h1%3A2067572.md)

## Why fixes fail
E4 shows a fix for one auth path (LDAP) regressing enforcement on sibling paths; E6 shows a gate added to one controller while another route kept issuing the same credential.

## Impact and severity
Ranged from full admin/back-office takeover and PII/KYC exposure [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-clubwpt-gold.md) to device takeover at scale [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) and RCE [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md). Severity rises when the alternate route is unauthenticated, reachable directly, and yields a durable credential or admin state.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md
- E2: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-clubwpt-gold.md
- E3: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md
- E4: https://bugbountylibrary.com/r/h1%3A1285226.md
- E5: https://bugbountylibrary.com/r/blog%3Ahealdb-tech-blog-teradici-html.md
- E6: https://bugbountylibrary.com/r/h1%3A2067572.md