# CBC padding oracle auth bypass

CBC or AEAD encryption without integrity, nonce/IV reuse, or padding checks that leak validity

_Area: Web authentication and account takeover. Seen in 5 disclosed reports; latest 2021-07-29. Updated 2026-10-24._

## How it works
Encryption is treated as if it also proved integrity. When ciphertext is CBC-mode without a MAC, or a MAC/padding check responds differently to malformed input, the decryptor becomes an oracle: an attacker learns whether guessed padding or key bytes were right. Each answer leaks a little plaintext or key material. The broken assumption is that "it's encrypted, so it's safe" — confidentiality without authenticity lets an attacker mutate ciphertext and read the error behavior.

## Where it shows up
- CBC-mode encryption of cookies, tokens, or query params (e.g. `encquery`, auth cookies) with no separate MAC [E3](https://bugbountylibrary.com/r/h1%3A728110.md).
- Distinguishable error responses or timing on decrypt/padding failure [E3](https://bugbountylibrary.com/r/h1%3A728110.md)[E5](https://bugbountylibrary.com/r/h1%3A136986.md).
- Constant-time MAC/padding checks that skip a length validation [E5](https://bugbountylibrary.com/r/h1%3A136986.md).
- Related oracles worth flagging nearby: AEAD APIs where IV/nonce is set before the key, silently falling back to a static nonce [E1](https://bugbountylibrary.com/r/h1%3A170548.md); RSA/format oracles from legacy protocol endpoints sharing keys with modern TLS [E2](https://bugbountylibrary.com/r/h1%3A166629.md); protocol fields consumed even in modes where they should be absent [E4](https://bugbountylibrary.com/r/h1%3A138179.md).

## How to review
Check the invariant: every ciphertext is authenticated before any plaintext or error detail is exposed. Concretely: confirm encrypt-then-MAC (or an AEAD) covers the whole message; confirm decrypt failures return one uniform response and constant time; confirm padding/MAC checks validate buffer length before comparing fixed regions [E5](https://bugbountylibrary.com/r/h1%3A136986.md); confirm conditional protocol fields are rejected when they should be absent [E4](https://bugbountylibrary.com/r/h1%3A138179.md); and inventory shared keys across legacy and modern endpoints [E2](https://bugbountylibrary.com/r/h1%3A166629.md).

## Variants seen
- CBC padding oracle in a product's auth cookie/query param [E3](https://bugbountylibrary.com/r/h1%3A728110.md).
- Missing length check in a constant-time MAC/padding comparison [E5](https://bugbountylibrary.com/r/h1%3A136986.md).
- Static nonce from API call ordering in Ruby OpenSSL GCM [E1](https://bugbountylibrary.com/r/h1%3A170548.md).
- Cross-protocol Bleichenbacher oracle via SSLv2 EXPORT sharing RSA keys [E2](https://bugbountylibrary.com/r/h1%3A166629.md).
- Clear-key-length not enforced, turning handshake into a key oracle [E4](https://bugbountylibrary.com/r/h1%3A138179.md).

## Why fixes fail
A constant-time rewrite of the padding check reintroduced an oracle by omitting the length validation [E5](https://bugbountylibrary.com/r/h1%3A136986.md). Fixes that address timing but not the underlying missing integrity leave the oracle reachable.

## Impact and severity
Led to decryption of protected messages and potential authentication bypass [E3](https://bugbountylibrary.com/r/h1%3A728110.md), TLS session-key recovery [E2](https://bugbountylibrary.com/r/h1%3A166629.md)[E4](https://bugbountylibrary.com/r/h1%3A138179.md), and TLS traffic decryption by a MITM [E5](https://bugbountylibrary.com/r/h1%3A136986.md). Severity is high: shared keys across services [E2](https://bugbountylibrary.com/r/h1%3A166629.md) and public known-CVE products [E3](https://bugbountylibrary.com/r/h1%3A728110.md) widen reach and lower the bar for attackers.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A170548.md
- E2: https://bugbountylibrary.com/r/h1%3A166629.md
- E3: https://bugbountylibrary.com/r/h1%3A728110.md
- E4: https://bugbountylibrary.com/r/h1%3A138179.md
- E5: https://bugbountylibrary.com/r/h1%3A136986.md