# MFA bypass via alternate endpoint or flag

Second factor enforced per-endpoint or trusted from client flags; check every path that performs the sensitive action

_Area: Web authentication and account takeover. Seen in 10 disclosed reports; 6 confirmed bounties, median $1,000, range $500-$2,500; latest 2026-10-15. Updated 2026-10-23._

## How it works
MFA is treated as a property of one login flow or one endpoint, not of the user's session or the sensitive action itself. The server assumes a request arriving through the normal login path already passed the second factor, or that a client-supplied field (mode, secureLogin, a target account ID) reliably describes what the user is doing. Any other route that reaches the same capability — an alternate API, a legacy controller, a destructive endpoint, an enrollment route — then executes without the factor. The broken assumption is that "MFA enforced here" equals "MFA enforced for this action."

## Where it shows up
- Sensitive actions (transfer, delete, app-password) reachable through a second route besides the gated one [E1](https://bugbountylibrary.com/r/h1%3A10554.md)[E6](https://bugbountylibrary.com/r/h1%3A2197244.md)
- MFA challenge requests carrying mode/factor/trust flags the server reads back [E4](https://bugbountylibrary.com/r/h1%3A665722.md)
- Endpoints authenticating on a password-derived value (authPW) with no session or 2FA check [E6](https://bugbountylibrary.com/r/h1%3A2197244.md)
- 2FA enrollment/verify endpoints taking the account ID from the request body [E2](https://bugbountylibrary.com/r/h1%3A810880.md)
- Enrollment routes (TOTP, passkey) outside the secure-session middleware, needing only a valid JWT [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md)
- 2FA state bound to a cookie validated against the user rather than the specific session [E7](https://bugbountylibrary.com/r/h1%3A1050244.md)
- Linking an SSO provider that silently resets existing MFA state [E5](https://bugbountylibrary.com/r/h1%3A178293.md)
- Federated apps (EWS, mail) that authenticate domain creds without MFA while the portal enforces it; hardcoded service-account creds widen this [E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md)

## How to review
Enumerate every route that performs a sensitive action and confirm each independently enforces the factor; the invariant is that the second factor is required by the action, not by the entry point. Grep for authPW and password-derived auth on account-management endpoints and confirm a session/2FA layer sits in front [E6](https://bugbountylibrary.com/r/h1%3A2197244.md). Check that MFA decisions are made server-side from session state, never from client-supplied mode or trust flags [E4](https://bugbountylibrary.com/r/h1%3A665722.md). Confirm 2FA enrollment/verify derives the account from the session, not a body ID [E2](https://bugbountylibrary.com/r/h1%3A810880.md). For enrollment, compare route registration against the secure-session middleware group and confirm a current-factor or password re-prompt, not just a valid JWT [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md). For federated services, confirm the same creds are rejected at sibling endpoints (EWS, legacy APIs) that may skip the portal's MFA [E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md). Distinguish true bypass from intended device-trust: a valid trust cookie legitimately skips the challenge, but flipping factor type or secureLogin:false to skip it is not intended [E4](https://bugbountylibrary.com/r/h1%3A665722.md).

## Variants seen
- Alternate transfer endpoint skipping 2FA and trusting a client-supplied destination wallet ID (separate trust flaw) [E1](https://bugbountylibrary.com/r/h1%3A10554.md)
- 2FA link/verify trusting a body user ID, binding attacker authenticator to victim [E2](https://bugbountylibrary.com/r/h1%3A810880.md)
- Enrollment routes outside secure-session middleware, JWT-only, no re-auth [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md)
- Client-controlled mode/secureLogin flags skipping the phone-code check [E4](https://bugbountylibrary.com/r/h1%3A665722.md)
- SSO provider linking silently disabling existing 2FA [E5](https://bugbountylibrary.com/r/h1%3A178293.md)
- Destructive endpoint using password-derived authPW without 2FA [E6](https://bugbountylibrary.com/r/h1%3A2197244.md)
- Cross-session cookie swap clearing the 2FA gate (session-state binding) [E7](https://bugbountylibrary.com/r/h1%3A1050244.md)
- Federated EWS endpoint lacking MFA while ADFS enforces it, plus leaked service creds [E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md)

## Why fixes fail
Gates are enforced per-controller, so fixing one route leaves the sibling open: reset endpoints protected while enroll endpoints are not [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md); fixing one transfer path leaves the internal one [E1](https://bugbountylibrary.com/r/h1%3A10554.md).

## Impact and severity
Full account takeover, fund transfer, account deletion, and back-office access to PII [E1](https://bugbountylibrary.com/r/h1%3A10554.md)[E2](https://bugbountylibrary.com/r/h1%3A810880.md)[E6](https://bugbountylibrary.com/r/h1%3A2197244.md)[E8](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md). Severity rises when the bypass needs only a known password or a stolen JWT, and when the account holds admin or tenant-wide rights [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md)[E7](https://bugbountylibrary.com/r/h1%3A1050244.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A10554.md
- E2: https://bugbountylibrary.com/r/h1%3A810880.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-gfrc-g87h-7h5w.md
- E4: https://bugbountylibrary.com/r/h1%3A665722.md
- E5: https://bugbountylibrary.com/r/h1%3A178293.md
- E6: https://bugbountylibrary.com/r/h1%3A2197244.md
- E7: https://bugbountylibrary.com/r/h1%3A1050244.md
- E8: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md