# Unauthenticated setup and registration endpoints

Setup, install, register, or agent endpoints reachable without auth that mint admin sessions or dump credentials

_Area: Web authentication and account takeover. Seen in 5 disclosed reports; 2 confirmed bounties: $1,000 and $1,200; latest 2025-07-29. Updated 2026-10-23._

## How it works
A privileged action is gated only by reachability, not by identity. Each endpoint class carries its own trust assumption that breaks once the system is live:
- Installer/first-run pages assume they are only hit during provisioning, so they stay routable after deployment and hand out an admin session [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md)[E4](https://bugbountylibrary.com/r/h1%3A1626205.md).
- Lifecycle/install webhooks assume the caller is the platform, so they accept an undocumented tenant identifier and overwrite that tenant's secret [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md).
- Self-registration/OTP endpoints assume the tenant allows open signup, so they never consult the tenant's privacy/SSO policy [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md).
- Agent registration assumes the caller is a real agent, so it keys trust on a guessable tenant ID with no per-tenant secret [E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md).
Nothing in the request proves the caller is the installer, platform, or agent, so privileged work happens for an anonymous requester.

## Where it shows up
- Installer/first-run routes (setup-config, SetupCompleted, install, wizard) still routable after deployment [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md)[E4](https://bugbountylibrary.com/r/h1%3A1626205.md)
- Lifecycle/install webhooks accepting an undocumented tenant identifier (cloudId, clientKey) [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md)
- Self-registration and OTP-verify endpoints that never check tenant privacy/SSO settings [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md)
- Agent/device registration keyed only by a guessable tenant or Customer ID, no per-tenant secret [E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md)
- Public Swagger/API docs exposing internal auth endpoints [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md)
- Verbose errors naming hidden parameters on install endpoints [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md)

## How to review
For every endpoint that creates an account, grants a session, or returns stored credentials, ask what proves the caller is authorized. The invariant: privileged state changes require an authenticated principal with the right role, or a per-tenant secret the caller must possess. Concretely:
- Confirm setup/install routes are disabled post-install by a config flag or file removal, not merely unlinked; test the URL directly [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md)[E4](https://bugbountylibrary.com/r/h1%3A1626205.md).
- Confirm registration/OTP validate tenant privacy and SSO config before acting [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md).
- Confirm agent registration requires a per-tenant secret, not just an ID [E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md).
- Confirm lifecycle webhooks reject requests that target an existing tenant without proof of ownership [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md).

## Variants seen
- Leftover installer page granting an admin session [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md)
- Installer pointed at attacker-controlled database to mint an admin [E4](https://bugbountylibrary.com/r/h1%3A1626205.md)
- Lifecycle webhook overwriting a tenant's shared secret via undocumented cloudId [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md)
- Self-registration/OTP bypassing SSO-only policy using a non-secret app_id [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md)
- Agent registration keyed on guessable Customer ID dumping cleartext credentials [E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md)

## Impact and severity
Outcomes ranged from full admin takeover and RCE [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md)[E4](https://bugbountylibrary.com/r/h1%3A1626205.md) to permanent tenant DoS [E2](https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md), unauthorized access to private apps [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md), and theft of domain admin credentials [E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md). Severity is highest when the endpoint mints admin sessions or returns cleartext secrets, and worse when the only key is a guessable or publicly visible identifier [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md)[E5](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerabilities-in-papercut-print-management-software.md
- E2: https://bugbountylibrary.com/r/bc%3Aad3389b8-17eb-45df-a352-19502557e238.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-vulnerability-base44.md
- E4: https://bugbountylibrary.com/r/h1%3A1626205.md
- E5: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5.md