# Connection reuse auth context bleed

Reused connections or resumed sessions matched on host or username but not the full credential and auth context

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $2,162; latest 2026-09-10. Updated 2026-10-24._

## How it works
A connection or resumable session carries authentication state established once. Reuse logic decides whether a new request may ride that connection, but it matches on only part of the identity — host, username, or nothing — instead of the full credential and the exact auth context. When the match is too loose, a request that never authenticated inherits the earlier client's authenticated state. The broken assumption: "same connection endpoint means same authenticated principal."

## Where it shows up
- Connection pools or caches whose reuse-match key omits a credential component; for SASL/OAUTH2, the bearer is stored separately from the username and left out of the match [E3](https://bugbountylibrary.com/r/h1%3A1552110.md).
- TLS session tickets shared across name-based virtual hosts on one IP:port, especially with client-cert auth [E1](https://bugbountylibrary.com/r/h1%3A2978267.md).
- Alternate listener/protocol paths (HTTP/3, h2c, raw TCP) that skip the per-connection context setup the main path performs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qqjf-53cj-pwvv.md).
- SNI vs Host header divergence changing which vhost's ticket is accepted [E1](https://bugbountylibrary.com/r/h1%3A2978267.md).

## How to review
Identify every place a connection or session is reused, then check the reuse predicate. The invariant: a reused connection may serve a request only if the request's full credential and auth context equal those that authenticated the connection. For per-connection auth (NTLM/Negotiate, client certs), confirm each listener/protocol path installs the same per-connection holder; a missing initialization that falls back to a shared pool is the bug [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qqjf-53cj-pwvv.md). For session tickets, confirm isolation per virtual host, not per IP:port [E1](https://bugbountylibrary.com/r/h1%3A2978267.md). For SASL/OAUTH2, confirm the bearer participates in the reuse match, not just host and username [E3](https://bugbountylibrary.com/r/h1%3A1552110.md).

## Variants seen
- TLS ticket resumption crossing vhosts, bypassing client-cert auth [E1](https://bugbountylibrary.com/r/h1%3A2978267.md).
- HTTP/3 path skipping AddTransportOnContext, inheriting a victim's NTLM backend connection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qqjf-53cj-pwvv.md).
- OAUTH2 bearer not part of SASL connection reuse match [E3](https://bugbountylibrary.com/r/h1%3A1552110.md).

## Impact and severity
Authentication bypass: unauthenticated clients inherit another principal's authenticated session [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-qqjf-53cj-pwvv.md)[E3](https://bugbountylibrary.com/r/h1%3A1552110.md), or client-cert auth is defeated [E1](https://bugbountylibrary.com/r/h1%3A2978267.md). Severity rises when the bleed is silent and requires no credentials, and when shared infrastructure (one IP:port, one backend pool) widens the victim set.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2978267.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-qqjf-53cj-pwvv.md
- E3: https://bugbountylibrary.com/r/h1%3A1552110.md