Browse / Bypasses / Two-factor and verification codes

Getting past two-factor and verification codes

2FA, OTP and code checks that can be skipped, reused or guessed. 127 disclosed reports got past one; the 100 most upvoted are below.

1. Potential pre-auth RCE on Twitter VPNOS Command Injection · critical · X / xAI
   $20,1601,246 votes
2. OTP token bypass in accessing user settingsImproper Authentication - Generic · Razer
   $1,000339 votes
3. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium · Shopify
   310 votes
4. 2FA bypass by sending blank codeImproper Authentication - Generic · Glassdoor
   303 votes
5. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium · HackerOne
   $10,000208 votes
6. 2FA Bypass leads to impersonation of legimate usersImproper Authentication - Generic · high · Drugs.com
   207 votes
7. TikTok 2FA BypassImproper Authorization · medium · TikTok
   $1,564194 votes
8. Absence of Token expiry leads to Unauthorized login AccessImproper Authentication - Generic · critical · Affirm
   155 votes
9. Bypassing HackerOne 2FA due to race conditionBusiness Logic Errors · medium · HackerOne
   139 votes
10. Business Logic Error – Bypass of OTP Verification During Signup on hover.comBusiness Logic Errors · Tucows (VDP)
    135 votes
11. Yet Another OTP code Leaked in the API ResponseImproper Authentication - Generic · critical · MTN Group
    135 votes
12. Can see phone numbers of others by providing mail addressInformation Disclosure · high · LinkedIn
    111 votes
13. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
    106 votes
14. 2FA requirement bypass when inviting team membersImproper Access Control - Generic · medium · Omise
    105 votes
15. Account Takeover in Password Reset FunctionAuthentication Bypass · critical · Mars
    105 votes
16. PIN bypass in PassCodeActivity via back buttonImproper Authentication - Generic · medium · Nextcloud
    $150101 votes
17. Email OTP/2FA BypassImproper Authentication - Generic · critical · Drugs.com
    100 votes
18. Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    98 votes
19. 2FA bypass possible on https://authsvc.singlestore.comAuthentication Bypass · medium · SingleStore
    96 votes
20. Account Takeover via SMS Authentication Flow Improper Authentication - Generic · high · Zenly
    94 votes
21. PIN 📌 BYPASS 🥷Improper Authentication - Generic · high · Yoti
    84 votes
22. “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredImproper Authentication - Generic · medium · Superhuman (formerly Grammarly)
    $2,50082 votes
23. Information disclosure -> 2fa bypass -> POST exploitation Information Disclosure · medium · Algolia
    76 votes
24. Parental Pin BypassPrivilege Escalation · Showmax
    $2,00075 votes
25. bypass parental pin succesfullyImproper Authentication - Generic · Showmax
    $20072 votes
26. Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppImproper Authentication - Generic · high · Grab
    68 votes
27. Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recoveryImproper Authentication - Generic · critical · HackerOne
    67 votes
28. Login email verification bypass via `/oauth/token`.Missing Critical Step in Authentication · GitLab
    66 votes
29. Two-factor authentication enforcement bypassImproper Authentication - Generic · high · Nextcloud
    $75064 votes
30. Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lockInformation Disclosure · low · Nextcloud
    58 votes
31. Login Bypass to OTP EnumerationImproper Authentication - Generic · Genasys Technologies
    57 votes
32. Payment PIN Verification BypassImproper Access Control - Generic · Razer
    $1,00057 votes
33. bypass two-factor authentication in Android apps and webAuthentication Bypass Using an Alternate Path or Channel · medium · TikTok
    55 votes
34. Missing ownership check in 2FA for secondary client loginImproper Authentication - Generic · critical · LY Corporation
    52 votes
35. No Rate Limiting On Phone Number Login Leads to Login BypassImproper Authentication - Generic · medium · Smule
    51 votes
36. Two factor authentication bypassImproper Authentication - Generic · medium · HackerOne
    47 votes
37. Two-factor authentication bypass on Grab Android AppImproper Authentication - Generic · medium · Grab
    46 votes
38. Bypass Email Verification in Customer PortalImproper Access Control - Generic · low · Mattermost
    45 votes
39. Email not verified when changing afterwards on apps.nextcloud.comViolation of Secure Design Principles · low · Nextcloud
    42 votes
40. bypass two-factor authentication.Improper Authentication - Generic · medium · LinkedIn
    41 votes
41. Improper Access Control allows OTP bypassImproper Access Control - Generic · medium · Lark Technologies
    40 votes
42. Misconfiguration in Two Factor AuthorisationImproper Authentication - Generic · Shopify
    $1,50040 votes
43. Business Logic error leads to bypass 2FA requirement Business Logic Errors · high · HackerOne
    39 votes
44. Two-factor authentication bypass lead to information disclosure about the program and all hackers participateInformation Disclosure · high · HackerOne
    37 votes
45. Bypass two-factor authenticationImproper Authentication - Generic · Slack
    36 votes
46. Bypass two-factor authenticationImproper Authentication - Generic · low · Cloudflare Public Bug Bounty
    $25034 votes
47. PIN bypassImproper Authentication - Generic · critical · MyEtherWallet
    34 votes
48. Disable 2FA via CSRF (Leads to 2FA Bypass)Cross-Site Request Forgery (CSRF) · Mail.ru
    34 votes
49. BYASSING OTP VerificationViolation of Secure Design Principles · bitaccess
    34 votes
50. Bypassing Two-Factor Authentication via Account Deactivation and Password ResetImproper Access Control - Generic · HackerOne
    33 votes
51. App PIN code can be bypassed in Files iOSImproper Authentication - Generic · low · Nextcloud
    $10033 votes
52. Insecure 2FA/authentication implementation creates a brute force vulnerabilityViolation of Secure Design Principles · GitLab
    33 votes
53. Sign in with Apple works on existing accounts, bypasses 2FAImproper Authentication - Generic · high · Cloudflare Public Bug Bounty
    $1,00032 votes
54. Improper Authentication - 2FA OTP ReusableImproper Authentication - Generic · high · HackerOne
    31 votes
55. [H1-2006 2020] Connecting the dots to send hackers their Bug BountyCode Injection · critical · h1-ctf
    30 votes
56. 2FA Bypass via Leaked CookiesImproper Authentication - Generic · medium · HackerOne
    28 votes
57. Session Not Expire / 2FA BypassInsufficient Session Expiration · medium · HackerOne
    28 votes
58. Rate-limit bypassImproper Authentication - Generic · Slack
    $50027 votes
59. Bypassing password authentication of users that have 2FA enabledImproper Authentication - Generic · GitLab
    27 votes
60. Bypassing 2FA with conventional session management - open.rocket.chatImproper Authentication - Generic · low · Rocket.Chat
    25 votes
61. Otp bypass in verifying ninImproper Authentication - Generic · high · MTN Group
    25 votes
62. Email Verification Bypass by bruteforcing when setting up 2FAImproper Restriction of Authentication Attempts · low · Evernote
    $15023 votes
63. [H1-2006 2020] Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or using a custom API attack toolPrivilege Escalation · critical · h1-ctf
    23 votes
64. 2FA Bypass via Response Manipulation on Login PageAuthentication Bypass · medium · U.S. Dept Of Defense
    22 votes
65. 2FA requirement bypass when claiming bounty Business Logic Errors · HackerOne
    22 votes
66. Обход 2ух-шаговой авторизации / 2FA BypassImproper Authentication - Generic · VK.com
    $1,00021 votes
67. India - OTP bypass on Phone number verification for account creationImproper Authentication - Generic · medium · Starbucks
    20 votes
68. bypass of 2FAImproper Authentication - Generic · high · Nextcloud
    $75020 votes
69. TOTP Authenticator implementation Accepts Expired CodesImproper Authentication - Generic · high · HackerOne
    19 votes
70. OTP bypass - Unintended disclosure of OTP to client allows attacker to manage users' subscriptionsIncorrect Authorization · medium · MTN Group
    19 votes
71. App pin of the Android app can be bypassed via 3rdparty apps generating deep linksImproper Authentication - Generic · low · Nextcloud
    18 votes
72. Two Factor Authentication BypassImproper Restriction of Authentication Attempts · medium · Ubiquiti Inc.
    18 votes
73. Bypassing 2FA for BTC transfersImproper Authentication - Generic · Coinbase
    $1,00018 votes
74. Rate limit function bypass can leads to occur huge critical problem into website. Improper Access Control - Generic · medium · Courier
    16 votes
75. Bypass OTP verification when placing OrderImproper Authentication - Generic · Eternal
    14 votes
76. Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FAImproper Authentication - Generic · medium · HackerOne
    13 votes
77. [H1-2006 2020] 36 hours of brain cycles utilized on solving a neat puzzleh1-ctf
    13 votes
78. [H1-2006 2020] CTF Writeup!critical · h1-ctf
    13 votes
79. Bypass OTP verification when placing OrderImproper Access Control - Generic · high · Eternal
    13 votes
80. Bypass verification of email while creating account(No rate limiting enable for verification code)Improper Authentication - Generic · MapLogin
    13 votes
81. Новый 2FA BypassImproper Authentication - Generic · VK.com
    $1,00012 votes
82. [H1-2006 2020] Bounty Pay CTF challengeImproper Access Control - Generic · critical · h1-ctf
    11 votes
83. [H1-2006 2020] Multiple vulnerabilities allow to leak sensitive information Improper Access Control - Generic · h1-ctf
    11 votes
84. [H1-2006 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical · h1-ctf
    11 votes
85. 2FA bypass - confirmation tokens don't expireImproper Access Control - Generic · medium · GSA Bounty
    11 votes
86. Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store OwnerPrivilege Escalation · medium · Shopify
    10 votes
87. [H1-2006] CTF WriteupImproper Access Control - Generic · critical · h1-ctf
    10 votes
88. [H1-2006 2020] CTF Writeuph1-ctf
    10 votes
89. [H1-2006 2020] Multiple vulnerabilities leading account takeoverPrivilege Escalation · critical · h1-ctf
    10 votes
90. twofactor_auth bypassable if provider fails to loadImproper Authentication - Generic · low · Nextcloud
    10 votes
91. [H1-2006 2020] From multiple vulnerabilities to complete ATO on any customer account and staff adminViolation of Secure Design Principles · critical · h1-ctf
    9 votes
92. 07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verificationInformation Disclosure · curl
    8 votes
93. CVE-2026-12064: proto-default skips SSH verificationImproper Certificate Validation · low · curl
    8 votes
94. TOTP 2 Factor Authentication BypassImproper Authentication - Generic · high · Rocket.Chat
    8 votes
95. Authentication Bypass - Email Verification code bypass in account registration process.Improper Authentication - Generic · critical · UPchieve
    8 votes
96. [h1-2006 2020] Write up for H1-2006 CTFcritical · h1-ctf
    7 votes
97. CSRF - Add optional two factor mobile numberCross-Site Request Forgery (CSRF) · Slack
    $5007 votes
98. CVE-2026-80230: OpenSSL pinning bypassImproper Access Control - Generic · curl
    6 votes
99. Bypass local authentication (PIN code)Improper Authentication - Generic · medium · Rocket.Chat
    6 votes
100. @shakedko H1-2006 CTF writeupcritical · h1-ctf
     6 votes