# Auth check skipped by request shape

Privileged handler reachable via method alias, path suffix, internal re-execution, or sibling step that skips its auth check

_Area: Web authentication and account takeover. Seen in 5 disclosed reports; one confirmed bounty: $25,000; latest 2025-02-12. Updated 2026-10-23._

## How it works
Authentication is treated as a property of the endpoint, but it is really a property of the exact request shape that reaches the handler. Routing, method aliasing, path normalization, internal re-execution, or a step-gated multi-page flow can deliver a request to the same privileged code in a shape the auth check never covered. The handler then runs for an unauthenticated caller.

## Where it shows up
- Controllers branching on `request.get?`/`request.post?` while the router maps methods via `:via` (HEAD aliased to GET) [E2](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-05-github-oauth-bypass-html.md)
- Exact string equality on `Request.Path` where the framework appends PathInfo (`/protected.aspx/anything`) [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass.md)
- `Server.Execute`/`Server.Transfer` with user-controlled paths, re-running files outside the IIS auth pipeline [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)
- Feature toggles that only hide UI while the controller route stays registered [E5](https://bugbountylibrary.com/r/h1%3A2376929.md)
- Multi-step flows where a password gate is just a URL-gated page, swappable for a sibling endpoint [E4](https://bugbountylibrary.com/r/h1%3A796956.md)

## How to review
For every privileged handler, enumerate all request shapes that can reach it: HTTP methods (including HEAD and overrides), path suffixes and encodings, internal re-execution, proxy rewrites, and sibling steps in a multi-page flow. The invariant: the auth decision must be made on the same normalized request the handler acts on, and must run before any side effect. Confirm missing credentials fail closed. Confirm disabling a feature removes the route, not just the button. For method-aliased handlers, confirm CSRF and consent checks run on the aliased method too, not only on the assumed side-effect-free one [E2](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-05-github-oauth-bypass-html.md). Note that E3's PathInfo is a normalization issue, distinct from E2's method aliasing.

## Variants seen
- Method aliasing: HEAD routed to GET handler, skipping CSRF and consent [E2](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-05-github-oauth-bypass-html.md)
- Path suffix: PathInfo appended to Request.Path defeats equality check [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass.md)
- Internal re-execution bypassing the auth module [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)
- UI-only toggle leaving the controller reachable [E5](https://bugbountylibrary.com/r/h1%3A2376929.md)
- Path swap to a sibling endpoint in a multi-step flow [E4](https://bugbountylibrary.com/r/h1%3A796956.md)

## Why fixes fail
E3's patch replaced the flawed exact `Request.Path` string comparison with a resolved-handler check; the equality check was the vulnerable code, not the fix. A string comparison against a path the framework can extend is inherently fragile.

## Impact and severity
Led to admin account creation and RCE [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass.md), OAuth permission grants [E2](https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-05-github-oauth-bypass-html.md), SSO merchant account takeover [E4](https://bugbountylibrary.com/r/h1%3A796956.md), and unauthenticated account self-registration via a rogue ID4Me provider [E5](https://bugbountylibrary.com/r/h1%3A2376929.md). In E1 the bypass exposed Web.config, which unlocked a Telerik deserialization RCE. Severity rises when the bypass reaches file-write, deserialization, or credential-reset primitives [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-teddykatz-com-2019-11-05-github-oauth-bypass-html.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass.md
- E4: https://bugbountylibrary.com/r/h1%3A796956.md
- E5: https://bugbountylibrary.com/r/h1%3A2376929.md