# Anonymous endpoints leaking reusable credentials

Public config, list, websocket or polling routes returning signing keys, tokens or credential IDs

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; latest 2026-09-04. Updated 2026-10-31._

## How it works
An endpoint meant for anonymous or low-privilege readers returns an object that also carries a reusable secret: a signing key, a credential ID, an embedded password, or a JWT. The assumption that breaks is "this data is safe because the endpoint is public." The response is filtered by a blocklist or by whatever the object happens to contain, not by an allowlist of safe fields. Any secret not explicitly removed, or any secret a background worker wrote into the object, flows straight to the caller.

## Where it shows up
- Config/read endpoints whose masking is a blocklist (`GetMaskedConf`, `HideConfSecret`) rather than an allowlist [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg.md)
- Public config endpoints returning internal `flowData`/node definitions with credential IDs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-6f7g-v4pp-r667.md)
- List endpoints returning raw in-memory objects that polling code mutates in place to embed auth URIs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m.md)
- WebSocket replay of cached events to unauthenticated clients, plus REST endpoints returning full request objects [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq56-hvg6-wvm5.md)
- Sibling endpoints (refresh, test, get) with no auth check on the referenced credential ID [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-6f7g-v4pp-r667.md)

## How to review
For each anonymous route, enumerate every field in the response and ask whether it is a secret or can reconstruct one. The invariant: no response reachable without authentication may contain a value that grants access elsewhere (signing key, token, or a credential ID usable by an unauthenticated sibling). Diff the normal read path against any export/clone path that explicitly nulls secrets — if export clears a field and read does not, that field leaks [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg.md). Check whether background workers mutate returned objects to add derived secrets [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m.md). Check whether cached events are filtered by the connecting client's auth level [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq56-hvg6-wvm5.md).

## Variants seen
- Signing key in masked config response [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg.md)
- Credential ID in public config plus unauthenticated refresh endpoint [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-6f7g-v4pp-r667.md)
- In-place-mutated server objects with embedded Basic credentials [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m.md)
- WebSocket event replay and polling exposing JWTs [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq56-hvg6-wvm5.md)

## Impact and severity
Forged session cookies [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg.md), harvested OAuth tokens [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-6f7g-v4pp-r667.md), replayed downstream credentials [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m.md), and full auth bypass via stolen JWT [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-fq56-hvg6-wvm5.md). Severity rises when the leaked secret is directly reusable against other systems and when no authentication is needed at all.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-6f7g-v4pp-r667.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-fq56-hvg6-wvm5.md