# Auth pipeline skipped by alternate path

Code that runs before or outside the auth check: Server.Execute, pre-check admin files, mismatched page/component dispatch

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $50,000; latest 2026-08-28. Updated 2026-10-31._

## How it works
Authorization is assumed to be a gate every request passes through before any sensitive code runs. That assumption breaks when a second execution path reaches the same code without passing the gate: a file that runs statements before its own auth check, a server-side include/execute that re-runs a file without re-running the auth module, or a dispatcher that authorizes the rendered page while executing a component owned by another page. The sensitive primitive (file write, config change, class load) is reachable, but the check that was supposed to guard it sits on a different path.

## Where it shows up
- Admin/panel files where `request.admintype`-style checks appear mid-file, after file-write, copy, upload or search logic [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md)
- `Server.Execute` / `Server.Transfer` with user-controlled paths in .NET/IIS code; these re-execute files without rerunning the IIS authorization module [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)
- Handlers (`.aspx`, `.ashx`, `.asmx`) and reflection endpoints that invoke arbitrary types/methods [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)
- Requests where the rendered page and the executed action/component are decoupled by a parameter [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited.md)
- Dynamic class loading or DB utilities reachable before authentication [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited.md)

## How to review
Trace every path to a sensitive primitive and confirm the auth check dominates it. The invariant: no file-write, config mutation, class load, or reflection call is reachable unless the authorization decision for that exact object has already passed on the same execution path. Concretely: read admin files top-to-bottom and confirm the check is the first statement, not mid-file [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md); grep decompiled code for `Server.Execute`/`Server.Transfer` with tainted paths and verify the target cannot be re-executed outside the auth module [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md); confirm the object authorized is the object executed, not a sibling page [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited.md).

## Variants seen
- Pre-auth code in admin CFM files before the admintype check, giving file-write/copy primitives [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md)
- Server.Execute re-execution bypassing IIS auth, leaking Web.config to unlock deserialization RCE [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md)
- Page/component authorization mismatch plus unsafe dynamic class loading for pre-auth code execution [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited.md)

## Impact and severity
All three reached remote code execution pre-auth, the highest severity. WAF presence did not help because the bypass was at the application's own dispatch layer [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md). Severity rises when the skipped check guards file write, config change, or class loading, since each converts an auth gap into code execution.

## Why fixes fail
Patching one endpoint leaves sibling files with the same pre-check pattern [E1](https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md); the class of bug is the ordering, not the single file.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-apple-rce-md.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-bypass-iis-authorisation-with-this-one-weird-trick-three-rces-and-two-auth-bypasses-in-s.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-papercut-actively-exploited.md