# Client-supplied auth flag bypass

Identity or privilege taken from headers, filenames, or unsigned tokens instead of a verified credential

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-11-02._

## How it works
Authentication should answer "who is this caller, and can they prove it?" Instead the code answers a weaker question: "did the caller send something that looks like an identity?" A header, filename, token field, or flag is parsed and trusted as proof, while the step that binds it to a real credential (signature check, nonce check, password check, server-side lookup) is missing or short-circuited. The broken assumption: that a syntactically valid identity claim was also verified.

## Where it shows up
- S3-compatible or signed-header parsers that accept an `Authorization` header naming a user without validating the signature [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md)
- Endpoints that authenticate a service with a shared secret, then take the target user identity from the same caller-controlled input (filename, body field) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md)
- Token handlers that decrypt a blob but never compare trailing bytes to the session nonce, or that skip signature checks when a security mode is None [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md)
- Verification state (`smsVerified`, admin flags) set from request headers [E4]
- Passwordless login helpers called with "skip password" arguments after a weaker check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md)

## How to review
Find every place an identity or privilege value enters the request path, then trace it to the credential check. The invariant: the identity used for the session must come from a source the caller cannot write, and must be bound to a secret the caller must prove. Check that: signatures are verified, not just parsed [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md); per-user identity comes from a signed claim, not the same input that carried the shared secret [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md); nonces and trailing bytes are compared, and no mode makes signature verification return true unconditionally [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md); verification flags are set server-side only [E4].

## How finders spotted it
- Recreated a public PoC of the S3 auth logic, then hunted logs for `AWS4-HMAC-SHA256 Credential=crushadmin/` entries lacking a session cookie to confirm real exploitation [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md)
- Source review noticed the upload handler conflated shared-secret service auth with per-user identity from the filename, then traced the login call to confirm no password check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md)
- Code reading found the decrypted blob's trailing bytes were never compared to the nonce; a dynamic test showed an empty password decrypted without error [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md)
- AI source review flagged header-trust verification; a human traced execution paths and found an intermittent bypass tied to a short-lived user cache [E4]

## Variants seen
- Unsigned but well-formed auth header treated as authenticated [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md)
- Shared secret plus attacker-chosen identity in filename [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md)
- Missing nonce check plus a mode that disables signature verification [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md)
- Client header sets a verification flag [E4]

## Impact and severity
Full admin takeover and OS-level RCE [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md); account takeover of any user including admin, with the secret recoverable via a timing oracle [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md); forged or replayed tokens [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md); self-reproducing account creation chained with unlimited invite codes [E4]. Impact rises when the bypass reaches admin, when the secret is guessable or leakable, and when chained with another weakness.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-crushftp-cve-2025-31161-auth-bypass-and-post-exploitation.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-qxvm-r42f-5p8j.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-mq36-523m-x7vv.md