# Intermittent authorization check bypass Auth enforced on some requests but skipped on retry, variation, or alternate page/route _Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2024-06-03. Updated 2026-11-02._ ## How it works An endpoint is supposed to require authentication or authorization, but the check is not applied on every path that reaches the protected logic. The assumption that breaks is "if the guard exists, every request passes through it." In practice the guard sits on one route, one page, or one code branch, while a sibling route, a retried request, or a differently-shaped request reaches the same handler without it. The result is a request that should be rejected but succeeds — sometimes only intermittently, which makes it easy to dismiss as flakiness. ## Where it shows up - Reverse proxies or gateways in front of an API where auth is enforced per-route rather than per-handler [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) - Static-asset routing rules that can be nudged (e.g. trailing `%2f`) to expose docs or reach backend paths [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) - Frameworks that authorize only the "root page" named in a service/multi-page parameter, leaving other pages unvalidated [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md) - Legacy wizard/setup pages that extend a different base class than the pages covered by manual per-page checks [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md) - Tokens whose claims are trusted client-side or cached, with no server-side revalidation after deprovisioning [E3](https://bugbountylibrary.com/r/h1%3A2122690.md) - Endpoints that succeed on retry after an initial rejection — intermittent enforcement [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) ## How to review The invariant: every request that reaches protected logic passes the same authorization check, regardless of route, retry, parameter shape, or page chaining. Check that the guard is attached to the handler or a shared base, not to individual routes or the root page only. For framework multi-page parameters, confirm each page's own validation runs, not just the root's [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md). For token-based access, confirm the server revalidates claims (user still exists, still enabled, still in org) on each request rather than trusting preserved JWT metadata [E3](https://bugbountylibrary.com/r/h1%3A2122690.md). For proxies, confirm auth is enforced at the backend, not only at the routing layer, and that path-normalization tricks cannot skip it [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md). ## How finders spotted it - Noticed traffic replay from a compromised device, then read the portal JavaScript to find the `/api/cbma/` reverse proxy, used `%2f` to bypass static routing and reach Swagger docs, and found the auth bypass by replaying requests until one succeeded [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) - Started from incident IOCs, reproduced post-auth RCE, patch-diffed builds, noticed Setup Wizard pages were never covered by manual auth checks and that the framework validated only the root page, then hunted remaining paths to OS command execution [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md) ## Variants seen - Intermittent enforcement: same endpoint rejects then accepts on retry [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) - Routing-rule bypass exposing protected docs/endpoints via URL encoding [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md) - Framework page-chaining that skips per-page authorization [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md) - Residual token claims honored after user deletion/disable, combined with a second live account [E3](https://bugbountylibrary.com/r/h1%3A2122690.md) ## Impact and severity Reached 700+ endpoints and device takeover plus PII for millions of modems [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md); chained with post-auth RCE to give unauthenticated RCE [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md); let a deprovisioned user reach SaaS apps [E3](https://bugbountylibrary.com/r/h1%3A2122690.md). Impact rises when the bypass is chained with another weakness (RCE, second account) and when it scales across many endpoints or tenants. ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems.md - E2: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-20.md - E3: https://bugbountylibrary.com/r/h1%3A2122690.md