# MFA bypass on alternate auth paths

Second factor bound to one login route, not the identity; other endpoints accept the credential alone

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; one confirmed bounty: $1,000; latest 2020-06-19. Updated 2026-10-24._

## How it works
MFA is enforced as a property of one login surface (the portal, the external-send flow, the ADFS front door) rather than of the identity. Any other path that authenticates the same user — an internal API, a legacy protocol endpoint, a federated service — accepts the credential alone. The assumption that breaks: "if they logged in with MFA, every action is MFA-protected." In practice the second factor is bound to a route, not to the session or the account.

## Where it shows up
- An action endpoint (e.g. internal transfer) that skips the 2FA check applied to the equivalent external action [E1](https://bugbountylibrary.com/r/h1%3A10554.md)
- A feature gated only in the UI, with no matching backend precondition [E1](https://bugbountylibrary.com/r/h1%3A10554.md)
- A client-supplied destination/identity field trusted as "internal" [E1](https://bugbountylibrary.com/r/h1%3A10554.md)
- A legacy protocol endpoint (EWS) that authenticates domain credentials directly, while MFA lives only at the ADFS/OWA portal [E3](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md)
- Adjacent: a legacy MFA-less test tenant plus an over-consented OAuth app reachable from production [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md)

## How to review
Enumerate every authentication path for the same identity: portal, API, legacy protocol, federated service, OAuth apps, test tenants. For each, confirm the invariant: the second factor is required at the identity/session level, so no alternate route yields an authenticated session or sensitive action without it. Check that backend preconditions match UI gating, that destination fields are validated server-side, and that legacy tenants/apps are inventoried and either MFA-bound or removed.

## Variants seen
- Internal action endpoint skips 2FA and trusts a client-supplied wallet ID [E1](https://bugbountylibrary.com/r/h1%3A10554.md)
- Legacy protocol endpoint (EWS) authenticates domain credentials without MFA despite ADFS [E3](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md)
- Adjacent: MFA-less legacy test tenant plus over-consented OAuth app grants tenant-wide access [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md)

## Impact and severity
Ranged from unauthorized fund transfer [E1](https://bugbountylibrary.com/r/h1%3A10554.md) to full mailbox read and GAL dump [E3](https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md), and in the adjacent case to tenant-wide admin creation and mass mailbox access [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md). Severity rises with the privilege of the bypassed identity and the breadth of the alternate path; legacy and test assets left federated into production widened blast radius [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A10554.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-midnight-blizzard-microsoft-breach-analysis-and-best-practices.md
- E3: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration.md