# Auth bypass via trusted local origin

Auth checks that trust loopback, empty Referer, or forwarded internal tokens instead of real client identity

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-09-23. Updated 2026-11-01._

## How it works
An auth decision is made on a property that the attacker can control or that collapses under normal deployment. Three shapes: a missing value (empty Referer) is treated as "valid" rather than "unknown"; a socket address (127.0.0.1) is treated as "local" even though a reverse proxy makes every remote client appear local; and an internal identity token is attached based on context presence rather than actual authentication. In each case the check looks strict but the trusted bucket is reachable by untrusted callers.

## Where it shows up
- Origin/Referer allowlist checks that compare against a domain but do not reject absent values [E1](https://bugbountylibrary.com/r/h1%3A168116.md)
- "Is this request local?" gates based on socket peer address, behind nginx/same-host proxies [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md)
- Identity headers (x-tsdproxy-id, X-Forwarded-For, X-Real-IP) trusted from localhost [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md)
- Middleware that stores a zero-value identity in context and a getter returning ok=true for it [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md)
- Proxies that inject an internal auth token into every upstream request unconditionally [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md)

## How to review
- For any allowlist comparison, ask: what happens on empty, missing, or malformed input? The invariant: unknown must fail closed, never match.
- For locality checks, trace the documented deployment. The invariant: the trusted-address decision must be made on the real client, not the proxy hop; forwarded headers must be validated or the proxy must be the only path.
- For identity injection, gate on a verified authentication result, not on context presence. The invariant: ok=true implies a real, authenticated principal; zero values must return ok=false.
- Check whether internal secrets are forwarded to backends that should not hold them [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md).

## How finders spotted it
- Noticed the bridge validated Referer, hypothesized an absent Referer would pass, and confirmed a page can strip it via a meta referrer tag [E1](https://bugbountylibrary.com/r/h1%3A168116.md)
- Compared direct backend vs proxied behavior and ran a header-spoof control to prove the bug is loopback trust after proxying, not naive header spoofing; tested Origin to scope affected clients [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md)
- Code review of the proxy rewrite path: saw WhoisFromContext return ok=true for a zero-value Whois, so the token was set unconditionally; then traced admin.go trusting x-tsdproxy-id from localhost when the token matched [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md)

## Variants seen
- Empty/missing Referer accepted as trusted origin [E1](https://bugbountylibrary.com/r/h1%3A168116.md)
- Loopback socket address trusted as local behind a reverse proxy [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md)
- Internal auth token forwarded to all backends and replayable from localhost [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md)

## Impact and severity
E1 let any site steal victims' OAuth credentials via the login bridge [E1](https://bugbountylibrary.com/r/h1%3A168116.md). E2 exposed model catalog and upstream provider credentials, escalating to abuse of the operator's provider credentials [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md). E3 escalated from backend code execution to full management API: config/topology enumeration, service restart/pause (DoS), and webhook-triggered SSRF [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md). Impact rises when the trusted bucket reaches secrets or admin surfaces, and when the bypass needs no victim interaction.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A168116.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-x5c9-v98j-722r.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-g936-7jqj-mwv8.md