# Auth cache and default bypasses

Auth decisions that skip secret comparison, fail open, or collapse identities via wrong keys or defaults

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; latest 2026-10-09. Updated 2026-11-01._

## How it works
Authentication is supposed to end in a comparison of a secret, or a decision that fails closed. These bugs break that assumption in three ways: a cache hit returns success without re-checking the secret; a wrapper fills a missing auth callback with a no-op that approves everything; or a derived identity is computed from the wrong field so many users map to one account. In each case the code looks like it authenticates, but the check that matters is unreachable or inverted.

## Where it shows up
- Auth caches keyed on attacker-supplied values (id, nonce, key_id) whose stored record lacks the secret or hash needed to re-verify [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md)
- Library wrappers that substitute a no-op or default callback when the real one is nil [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md)
- OAuth/provider mappers that hash or derive an ID from an output struct field instead of the parsed provider response [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md)
- Query operators that invert intent, e.g. `$ne: []` matching non-empty arrays where empty was meant [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md)
- Cleanup/delete logic keyed on the wrong field, leaving stale tokens valid [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md)

## How to review
- For every auth cache: is the cache key attacker-controlled, and does the cached record retain the secret/hash so the comparison (e.g. constant-time compare) still runs on a hit? The invariant: a cache hit must not skip secret verification [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md).
- For middleware/wrappers: trace what happens when the auth callback is nil. The invariant: missing auth config must fail closed, never fall back to a no-op [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md).
- For identity mapping: confirm the derived ID comes from the parsed provider response, not a freshly allocated struct. The invariant: distinct provider accounts must yield distinct local IDs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md).
- For query-based checks: read the comment stating intent, then verify the operator matches it; enumerate every field state (absent, empty, non-empty, unset) [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md).

## How finders spotted it
- Read the cache path of the key check and noticed the cache key came from user input while the cached data omitted the hash, making the secret comparison unreachable [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md)
- Compared a high-level wrapper's nil handling against the low-level validator's fail-closed check, spotting the no-op substitution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md)
- Read the provider mapper and saw the hash input was the destination field, not the parsed ID; a test asserting a fixed hash constant confirmed it [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md)
- Diffed a comment saying "empty or inexistant" against the `$ne: []` operator, then enumerated token lifecycle states to confirm the inversion [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md)

## Variants seen
- Cache-hit bypass of API key validation [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md)
- Fail-open default auth function in a validation wrapper [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md)
- Identity collapse across all accounts of one OAuth provider [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md)
- Inverted query operator plus wrong-field token deletion enabling MFA bypass [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md)

## Impact and severity
E1 gives full administrative access by enumerating key_id 1 [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md). E2 lets unauthenticated requests reach protected handlers [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md). E3 collapses all Patreon logins into one account, inheriting its privileges or paid state [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md). E4 lets password-only attackers bypass TOTP/MFA for full API access, with a second bug extending the window [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md). Impact rises when the shared identity holds elevated rights [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md) or when a secondary bug widens the bypass [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-r44w-v6gf-x3p6.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-r277-6w6q-xmqw.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-f6qq-3m3h-4g42.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-v9xm-ffx2-7h35.md