# Auth tokens leaked in API responses

Credential or token fields serialized to a different principal, or a token whose real scope exceeds its label

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; latest 2025-01-22. Updated 2026-10-23._

## How it works
A value that authenticates a user is placed where a different principal can read it. The broken assumption is that a token is visible only to its owner, or that its real scope matches what its label or UI implies. In practice the token is serialized into an API response, embedded in a link, or shown in a session list, and it authenticates more broadly than its presentation suggests. A related shape: a temporary identity-swap session is exposed to the swapped-in party, and ending it restores the original privileged session cookie [E1](https://bugbountylibrary.com/r/h1%3A493324.md).

## Where it shows up
- User or profile objects returned by APIs containing fields like `session_id`, `PHPSESSID`, `gauth_secret`, or other token-like values [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md)[E5](https://bugbountylibrary.com/r/h1%3A1276373.md)
- Per-record API responses (breach or email lists) carrying verification tokens for unverified entries [E4](https://bugbountylibrary.com/r/h1%3A2712583.md)
- 2FA enroll/renew/status responses returning the TOTP shared secret or backup codes [E5](https://bugbountylibrary.com/r/h1%3A1276373.md)
- Impersonation or support-access sessions visible in the impersonated user's Active Sessions list [E1](https://bugbountylibrary.com/r/h1%3A493324.md)
- Mobile or alternate API surfaces returning richer objects than the web app [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md)

## How to review
The invariant: any value that authenticates a user must never appear in a response to a different principal, and its real scope must equal its presented scope. For each API response, enumerate fields and ask whether each is a credential. Diff the same response across several principals and against your own cookie to spot leaked session identifiers [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md). Note that a leaked session ID is the sole authorization token, so it means direct hijack, unlike a secondary token [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md). For identity-swap features, check whether the temporary session is visible to the impersonated party and whether ending it restores the original privileged session cookie [E1](https://bugbountylibrary.com/r/h1%3A493324.md). Verification tokens and TOTP secrets must stay server-side and never be serialized [E4](https://bugbountylibrary.com/r/h1%3A2712583.md)[E5](https://bugbountylibrary.com/r/h1%3A1276373.md).

## Variants seen
- Session ID returned in a user-lookup API response [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md)
- Email verification token leaked in a breaches API for unverified addresses [E4](https://bugbountylibrary.com/r/h1%3A2712583.md)
- TOTP shared secret returned by a 2FA renew endpoint [E5](https://bugbountylibrary.com/r/h1%3A1276373.md)
- Impersonation session exposed to the impersonated user, restoring the admin cookie on stop [E1](https://bugbountylibrary.com/r/h1%3A493324.md)

## Impact and severity
High to critical: full account takeover including admin accounts [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md), unauthorized verification and monitoring of any email [E4](https://bugbountylibrary.com/r/h1%3A2712583.md), 2FA bypass on critical actions [E5](https://bugbountylibrary.com/r/h1%3A1276373.md), and privilege escalation to admin [E1](https://bugbountylibrary.com/r/h1%3A493324.md). Severity rises when the token is long-lived, account-wide, and its true scope is hidden by the UI label.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A493324.md
- E2: https://bugbountylibrary.com/r/h1%3A1439026.md
- E3: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom.md
- E4: https://bugbountylibrary.com/r/h1%3A2712583.md
- E5: https://bugbountylibrary.com/r/h1%3A1276373.md