# Nil-accepted token validation bypass

Parsed credential yields nil/empty and matches unset nullable token columns, collapsing auth

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; 2 confirmed bounties: $100 and $2,000; latest 2025-11-21. Updated 2026-10-23._

## How it works
Auth code parses a presented credential (split, decode, lookup) into a value, then compares or queries on it. When the input is malformed or empty, the parse yields nil/empty instead of raising. If the code treats that nil as a legitimate key, the check collapses: a query like `find_by(id:, bot_token: nil)` matches every record whose token column is also unset. The broken assumption is that a parsed credential is always present and meaningful; nil silently becomes a valid key that matches unset columns.

## Where it shows up
- Credential parsing that splits/decodes and can yield nil or empty (e.g. `"1-".split('-')`).
- `find_by`/query comparisons against token columns that are nullable and unset for normal accounts.
- Auth paths where a parse error is rescued or swallowed and execution continues.
- Lookups that accept an empty string or nil as a search value rather than rejecting it.

## How to review
Trace each credential from input to the authorization decision. The invariant: a missing, empty, or unparseable credential must fail closed, and a nil/empty value must never be compared against a nullable column that is nil for legitimate accounts. Confirm parse failures raise or return an explicit reject, and that token lookups require a non-nil, non-empty value before querying. Check whether the matched column is nullable and commonly unset; if so, a nil key is a wildcard.

## Variants seen
- Split-derived nil token matching nil bot_token on all normal users [E1](https://bugbountylibrary.com/r/h1%3A3329310.md).

## Impact and severity
Unauthenticated impersonation of any user and posting as them [E1](https://bugbountylibrary.com/r/h1%3A3329310.md). Severity rises when the nil match is broad (every account with an unset column) and the endpoint is reachable without authentication.

## Why fixes fail
Partial fixes that block one malformed shape leave other nil/empty paths open; the durable fix is to reject nil/empty before the query, not to special-case one input.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3329310.md
- E2: https://bugbountylibrary.com/r/h1%3A2122690.md
- E3: https://bugbountylibrary.com/r/h1%3A1615790.md