# SSO handoff missing scope recheck

Handoff endpoints that mint sessions or tokens without rechecking role, scope, or expiry

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $200; latest 2026-09-10. Updated 2026-10-23._

## How it works
A handoff step (SSO bridge, token exchange) accepts a credential and issues a stronger one. The receiving side trusts the *identity* proven by the incoming credential but never re-derives the *authorization*: role, scope, or expiry. The assumption that breaks is "a valid credential implies the right to the next step." Validity and authority are different properties, and the handoff conflates them.

## Where it shows up
- Token exchange that validates signature/issuer but not scope [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md)
- SSO bridge endpoints on secondary subdomains that mint sessions for the impersonated owner [E3](https://bugbountylibrary.com/r/h1%3A1071918.md)
- Path/trailing-slash variants of auth endpoints that skip anonymous-access checks [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md)
- Alternate API surfaces (GraphQL, websocket) that check only token scope, not global policy [E4](https://bugbountylibrary.com/r/h1%3A1192460.md)
- Adjacent: objects whose own SID/credential can satisfy their authorization check [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dmsa-ouroboros-credential-extraction-windows-server-2025.md); legacy tenants or OAuth apps with tenant-wide admin consent reachable from production [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md)

## How to review
For every handoff, identify the credential consumed and the credential issued. The invariant: the issued credential's authority must be the intersection of the caller's actual role/scope and the target's requirements, re-evaluated at the handoff, with expiry enforced. Check that path variants reach the same check [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md), that every alternate surface re-applies the same policy [E4](https://bugbountylibrary.com/r/h1%3A1192460.md), and that no object can authorize itself [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dmsa-ouroboros-credential-extraction-windows-server-2025.md). Test each handoff endpoint under low-privilege, shared-access, and impersonation sessions [E3](https://bugbountylibrary.com/r/h1%3A1071918.md).

## Variants seen
- Token scope not rechecked on exchange [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md)
- SSO bridge trusting shared-access session for owner portal [E3](https://bugbountylibrary.com/r/h1%3A1071918.md)
- Coarse scope check on GraphQL bypassing deactivated-user policy [E4](https://bugbountylibrary.com/r/h1%3A1192460.md)
- Self-authorizing directory object via own membership/credential [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dmsa-ouroboros-credential-extraction-windows-server-2025.md)
- Over-consented legacy OAuth app bridging test tenant into production [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md)

## Why fixes fail
Patching the main app leaves SSO bridges and path variants unchecked [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md)[E3](https://bugbountylibrary.com/r/h1%3A1071918.md); scope must be re-derived at every handoff endpoint, not just the primary. Legacy tenants and pre-consented apps persist after the primary account is fixed [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## Impact and severity
Chained to admin takeover and backdoors [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md) and full mailbox read [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md); shared-access users reached owner tickets and profile [E3](https://bugbountylibrary.com/r/h1%3A1071918.md). Severity rises when the handoff is unauthenticated or self-sustaining [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dmsa-ouroboros-credential-extraction-windows-server-2025.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dmsa-ouroboros-credential-extraction-windows-server-2025.md
- E3: https://bugbountylibrary.com/r/h1%3A1071918.md
- E4: https://bugbountylibrary.com/r/h1%3A1192460.md
- E5: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md