# Auth parameter precedence and parser differential

Auth and reset flows reading a different parameter source or parse than the one validated

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; 2 confirmed bounties: $250 and $1,500; latest 2025-02-12. Updated 2026-11-02._

## How it works
An auth or account flow validates one representation of a value but acts on another. The gap is between where a value is checked and where it is consumed: a front-end checks the first header while the backend reads a duplicate; a deserializer skips a rejected key but keeps parsing its bytes; a form reads GET before POST; an email field is split on delimiters after being treated as one address. In each case the assumption "the value I validated is the value that gets used" breaks because two parsers disagree on which occurrence, source, or field wins.

## Where it shows up
- Front-end proxy or ISAPI filter that inspects only the first occurrence of a routing/transaction header but forwards all of them [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362.md)
- Deserializer loops with a `skip`/`goto` branch that frees a rejected key but continues on the same buffer [E2](https://bugbountylibrary.com/r/h1%3A159946.md)
- Credential or reset forms where the same field name is accepted from both query string and body [E3](https://bugbountylibrary.com/r/h1%3A96636.md)
- Signup/activation endpoints taking an email in a URL parameter that is later split on `;`, `,` or whitespace [E4](https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md)
- Any place a value is normalized or filtered in one layer and re-parsed in another

## How to review
Identify the exact value that authorizes or binds an account, then trace every parse of it from edge to sink. The invariant: the bytes the validator approved must be the same bytes the consumer acts on, with no second occurrence, alternate source, or delimiter-split copy able to substitute. Check that duplicate headers are rejected, not just first-checked; that skip branches advance past the whole value; that GET cannot override POST for secrets; that an email field resolves to exactly one address before mailing.

## How finders spotted it
- BinDiff showed no patch in the front-end DLL, pushing review to find it validated only the first header while forwarding duplicates [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362.md)
- Reading the session decode loop, noticing `goto skip` advanced `p = q` without stopping parsing, leaving value bytes to be re-read as a new pair [E2](https://bugbountylibrary.com/r/h1%3A159946.md)
- Noticing the change_password endpoint accepted `newpassword` as query params that took precedence over POST [E3](https://bugbountylibrary.com/r/h1%3A96636.md)
- Hypothesizing two semicolon-separated emails on the activation link; both mailboxes got identical links to one account [E4](https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md)

## Variants seen
- Header smuggling past a first-occurrence check to reach a removed backend path [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362.md)
- Deserializer skip-continue injecting serialized data [E2](https://bugbountylibrary.com/r/h1%3A159946.md)
- GET-over-POST precedence on a reset form [E3](https://bugbountylibrary.com/r/h1%3A96636.md)
- Delimiter injection binding multiple emails to one account [E4](https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md)

## Impact and severity
Ranged from fixing a victim's password via a crafted link [E3](https://bugbountylibrary.com/r/h1%3A96636.md) and blind account takeover through multi-email binding [E4](https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md), to session forgery, API token theft and RCE when chained with SQLi and BinaryFormatter deserialization [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362.md). Impact rose with chaining and reach: E1 became mass-exploited; E2 chains to object injection. Bounties were modest (median 875) despite severe outcomes, so severity here tracks the downstream sink, not the parsing flaw alone.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362.md
- E2: https://bugbountylibrary.com/r/h1%3A159946.md
- E3: https://bugbountylibrary.com/r/h1%3A96636.md
- E4: https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover.md