# Unauthenticated registration leaks credentials

Registration, OTP, or agent endpoints reachable without auth that mint accounts or dump stored secrets

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2025-07-29. Updated 2026-11-01._

## How it works
An endpoint that creates identity (self-registration, OTP verification, agent auto-import) is treated as "pre-auth" and therefore trusted to run without authentication. The code then keys the new identity on a value the caller already controls — an app_id, a Customer ID, a tenant slug — and never re-checks the tenant's privacy or SSO policy. The broken assumption is that reaching the endpoint implies the caller is entitled to the tenant it names. Because the key is non-secret or guessable, anyone can mint a verified account or register a fake device inside someone else's tenant, and the response or subsequent config read hands back stored secrets.

## Where it shows up
- Register / verify-otp / signup routes outside the auth filter chain, or listed as public in Swagger/OpenAPI.
- Tenant or app identified only by a path/body ID (app_id, Customer ID) with no per-tenant secret or invite token.
- Registration handlers that never read the tenant's SSO-only / privacy / invite-required flags.
- Agent auto-import or device-registration endpoints that accept unauthenticated posts.
- Endpoints returning configuration dumps containing credentials (AD, probe, agent settings).
- Shipped default or hardcoded Basic-auth credentials guarding a sensitive endpoint.
- Raw query-language endpoints (HQL/JPQL/SOQL) reachable behind that weak gate.

## How to review
For every route that creates an account, verifies an OTP, or registers an agent, confirm the invariant: identity creation requires either an authenticated session, a per-tenant secret/invite, or an explicit check that the tenant permits open self-registration. Trace the tenant ID from request to authorization decision — if it is only used to look up data and never to authorize, it is unsafe. Confirm SSO-only tenants reject self-registration. For config-dump endpoints, verify the caller is authenticated and scoped to that tenant before any credential is serialized. For query endpoints, confirm authorization runs before evaluation and no shipped default credential bypasses it.

## Variants seen
- SSO-only app self-registration via unauthenticated register + verify-otp keyed on non-secret app_id [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md).
- Hardcoded Basic-auth credentials plus unauthenticated raw HQL endpoint exposing admin hashes [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md).
- Fake agent registration against a guessed Customer ID dumping cleartext AD admin credentials [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md).

## Impact and severity
Critical: full auth bypass into private tenants [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md), admin hash and DB write exposure [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md), cleartext domain-admin credential theft [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md). Worse when the tenant key is guessable or enumerable and when secrets are stored in cleartext in returned config.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-solarwinds-web-help-desk-arbitrary-hql-evaluation-cve-2021-35232.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md