# Auth parser differential trust bypass

Same input parsed twice by check and consumer that disagree on duplicates, namespaces, or delimiters

_Area: Web authentication and account takeover. Seen in 6 disclosed reports; 2 confirmed bounties: $1,000 and $2,500; latest 2026-10-23. Updated 2026-10-23._

## How it works
A security check parses an input with one parser and approves it. A separate component parses the same bytes differently to act on them. The two disagree on which duplicate, namespace, delimiter, or normalization is authoritative, so the consumer acts on data the validator never approved. Trust is placed on the parse, not on the bytes.

## Where it shows up
- Two parsers for one format: signature check vs. field read (REXML vs. Nokogiri) [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-fragile-lock.md)[E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-saml-roulette-the-hacker-always-wins.md)
- Duplicate entries where one side is first-wins and the other last-wins: tar entries, query params [E1](https://bugbountylibrary.com/r/h1%3A275269.md)[E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w8-3pqp-wr83.md)
- Key normalization plus duplicate precedence: keys lowercased into a map while the raw URL keeps both case variants [E4](https://bugbountylibrary.com/r/h1%3A1580493.md)
- Different delimiter sets between client and server for the same query string ('&' vs '&' and ';') [E6](https://bugbountylibrary.com/r/h1%3A126522.md)
- XML constructs that mutate on re-serialization or resolve differently: DOCTYPE ATTLIST duplicate xmlns, SYSTEM identifier quoting [E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-saml-roulette-the-hacker-always-wins.md); void canonicalization on relative-URI errors [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-fragile-lock.md)
- Raw substring match vs. parsed query on the same URI [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w8-3pqp-wr83.md)

## How to review
Find every place the same input is parsed twice: the check and the use. The invariant: the exact bytes the validator approved must be the exact bytes the consumer acts on, via one parser or a canonical form both agree on. Grep for two parse calls on the same bytes and for first/last-wins loops over entries or params (e.g. `for ... { m[k] = v }` vs. `return first`). Check duplicate handling (first vs. last), key normalization (lowercasing), namespace/prefix resolution, and delimiter sets. If a proxy validates then forwards, confirm the forwarded request is byte-identical to the validated one.

## Variants seen
- Duplicate archive entries: verify last, extract first [E1](https://bugbountylibrary.com/r/h1%3A275269.md)
- XML signature vs. logic parser, namespace confusion, void canonicalization [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-fragile-lock.md)
- DOCTYPE-driven namespace duplication and round-trip mutation [E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-saml-roulette-the-hacker-always-wins.md)
- Case-variant duplicate query params overriding signed values after key lowercasing [E4](https://bugbountylibrary.com/r/h1%3A1580493.md)
- Substring exemption vs. first-value parsed query on duplicated keys [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w8-3pqp-wr83.md)
- Client/server delimiter disagreement on the host parameter [E6](https://bugbountylibrary.com/r/h1%3A126522.md)

## Impact and severity
Led to forged signed packages [E1](https://bugbountylibrary.com/r/h1%3A275269.md), SAML auth bypass and unauthenticated admin access [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-fragile-lock.md)[E3](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-saml-roulette-the-hacker-always-wins.md), identity spoofing and replay [E4](https://bugbountylibrary.com/r/h1%3A1580493.md), unauthenticated event-stream access [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w8-3pqp-wr83.md), and OAuth credential redirection [E6](https://bugbountylibrary.com/r/h1%3A126522.md). Severity is high because the bypass defeats the trust boundary itself; worse when the consumer reaches privileged backends or signing/identity systems.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A275269.md
- E2: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-fragile-lock.md
- E3: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-saml-roulette-the-hacker-always-wins.md
- E4: https://bugbountylibrary.com/r/h1%3A1580493.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w8-3pqp-wr83.md
- E6: https://bugbountylibrary.com/r/h1%3A126522.md