Browse / Bypasses / Login and identity checks

Getting past login and identity checks

Authentication, SSO, session and password-reset checks. 392 disclosed reports got past one; the 100 most upvoted are below.

1. Bypass for #488147 enables stored XSS on https://paypal.com/signin againHTTP Request Smuggling · high · PayPal
   $20,0002,687 votes
2. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical · Shopify
   1,922 votes
3. Subdomain Takeover to Authentication bypass Improper Authentication - Generic · critical · Roblox
   783 votes
4. Shopify Stocky App OAuth MisconfigurationPrivilege Escalation · medium · Shopify
   527 votes
5. Flickr Account Takeover using AWS Cognito APIImproper Authentication - Generic · critical · Flickr
   440 votes
6. [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious FileImproper Access Control - Generic · Mail.ru
   340 votes
7. Shopify admin authentication bypass using partners.shopify.comImproper Authorization · critical · Shopify
   311 votes
8. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium · Shopify
   310 votes
9. Bypass Password Authentication for updating email and phone number - Security VulnerabilityImproper Authentication - Generic · high · X / xAI
   288 votes
10. OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageInformation Disclosure · medium · Semrush
    265 votes
11. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high · GitLab
    $3,000257 votes
12. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainReliance on Untrusted Inputs in a Security Decision · medium · GitLab
    249 votes
13. HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationImproper Null Termination · high · HackerOne
    228 votes
14. 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.comImproper Access Control - Generic · high · hostinger
    219 votes
15. Incorrect authorization to the intelbot service leading to ticket informationImproper Authentication - Generic · critical · TikTok
    $15,000219 votes
16. SAML Signature verification bypass allows logging into any user (with specific conditions)Improper Access Control - Generic · critical · GitHub
    196 votes
17. Through blocking the redirect in /* the attacker able to bypass Authentication To see Sensitive Data sush as Game Keys , Emails ,..Improper Access Control - Generic · Razer
    $1,000196 votes
18. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical · Uber
    183 votes
19. Authentication bypass on gist.github.com through SSH CertificatesImproper Access Control - Generic · high · GitHub
    $10,000182 votes
20. How The Hackers Saved ChristmasInformation Disclosure · critical · h1-ctf
    179 votes
21. Access token stealing.Missing Authorization · high · PlayStation
    $1,200177 votes
22. Account Takeover via Authentication Bypass in TikTok Account RecoveryAuthentication Bypass Using an Alternate Path or Channel · critical · TikTok
    $12,000172 votes
23. bypass sql injection #1109311SQL Injection · medium · Acronis
    164 votes
24. Bypass password reset rate limit protection at moneybird.com/passwordsUncontrolled Resource Consumption · high · Moneybird
    164 votes
25. Hackerone supports accounts organitation takeovermedium · HackerOne
    $2,500155 votes
26. Absence of Token expiry leads to Unauthorized login AccessImproper Authentication - Generic · critical · Affirm
    155 votes
27. [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMissing Authentication for Critical Function · Mail.ru
    143 votes
28. Admin Panel Accessed (OAuth Bypassed ) Command Injection - Generic · critical · Mapbox
    $4,000133 votes
29. Incorrect param parsing in Digits web authenticationImproper Authentication - Generic · X / xAI
    126 votes
30. Can see phone numbers of others by providing mail addressInformation Disclosure · high · LinkedIn
    111 votes
31. Authentication Bypass Leads To Complete Account TakeveOver on ██████████Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    109 votes
32. Subdomain takeover on svcgatewayus.starbucks.comPrivilege Escalation · critical · Starbucks
    109 votes
33. Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationInsecure Direct Object Reference (IDOR) · medium · GitHub
    108 votes
34. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic · X / xAI
    108 votes
35. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
    106 votes
36. Admin Authentication Bypass Lead to Admin Account Takeover Improper Authentication - Generic · medium · UPS VDP
    106 votes
37. Account Takeover in Password Reset FunctionAuthentication Bypass · critical · Mars
    105 votes
38. Subdomain takeover on usclsapipma.cv.ford.comPrivilege Escalation · high · Ford
    105 votes
39. SQL injection in https://www.acronis.cz/ via the log parameterSQL Injection · medium · Acronis
    103 votes
40. Wordpress Takeover using setup configuration at http://████.edu [HtUS]Misconfiguration · critical · U.S. Dept Of Defense
    $1,000102 votes
41. SQL Injection intensedebate.comSQL Injection · medium · Automattic
    102 votes
42. User account compromised authentication bypass via oauth token impersonationImproper Access Control - Generic · high · Picsart
    101 votes
43. Complete authentication bypass to admin permissionsSQL Injection · critical · Rocket.Chat
    100 votes
44. 2FA bypass possible on https://authsvc.singlestore.comAuthentication Bypass · medium · SingleStore
    96 votes
45. POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)Improper Authentication - Generic · medium · CoinMate.io
    93 votes
46. Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedImproper Authentication - Generic · critical · R3
    91 votes
47. SQL InjectionSQL Injection · high · U.S. Dept Of Defense
    91 votes
48. Subdomain takeover on wfmnarptpc.starbucks.comPrivilege Escalation · high · Starbucks
    91 votes
49. moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input ValidationImproper Input Validation · medium · Internet Bug Bounty
    $2,60089 votes
50. SAML Authentication Bypass on uchat.uberinternal.comImproper Authentication - Generic · high · Uber
    $8,50088 votes
51. Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signingBusiness Logic Errors · medium · MetaMask
    $35086 votes
52. Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationImproper Access Control - Generic · low · TikTok
    84 votes
53. PIN 📌 BYPASS 🥷Improper Authentication - Generic · high · Yoti
    84 votes
54. Login CSRF vulnerability on hackerone.comCross-Site Request Forgery (CSRF) · low · HackerOne
    $50084 votes
55. Persistent DOM-based XSS in https://help.twitter.com via localStorageCross-site Scripting (XSS) - Stored · medium · X / xAI
    84 votes
56. OneLogin authentication bypass on WordPress sites via XMLRPCCode Injection · Uber
    $7,00083 votes
57. “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredImproper Authentication - Generic · medium · Superhuman (formerly Grammarly)
    $2,50082 votes
58. Middleware Authentication Bypass on IBM PortalCommand Injection - Generic · critical · IBM
    80 votes
59. OAuth redirect uri validation bypass for :proxima_first_party_sync appsOpen Redirect · high · GitHub
    79 votes
60. TikTok's pixel/sdk.js leaks current URL from websites using postMessageImproper Authorization · medium · TikTok
    79 votes
61. credentials leakage in public lead to view dev websites Information Disclosure · low · Eternal
    78 votes
62. Improper Authentication Allows Making Appeals as Other UsersImproper Authentication - Generic · medium · U.S. Dept Of Defense
    77 votes
63. Unauthenticated GraphQL access by prepending __schema to private operationsAuthentication Bypass · medium · Enjin
    $50076 votes
64. Information disclosure -> 2fa bypass -> POST exploitation Information Disclosure · medium · Algolia
    76 votes
65. Authentication Bypass to (CVE-2023-2982)Authentication Bypass Using an Alternate Path or Channel · low · CS Money
    $10074 votes
66. myshopify.com domain takeoverBusiness Logic Errors · medium · Shopify
    71 votes
67. Authentication Bypass in Subscription Management EndpointInsecure Direct Object Reference (IDOR) · critical · lemlist
    68 votes
68. Bypass validation parts in AWS IAM Authenticator for KubernetesImproper Authentication - Generic · high · Kubernetes
    $2,50068 votes
69. Blind SQL injection at tsftp.informatica.comSQL Injection · critical · Informatica
    68 votes
70. Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppImproper Authentication - Generic · high · Grab
    68 votes
71. Improper Authentication (Login without Registration with any user) at ████Improper Authentication - Generic · high · U.S. Dept Of Defense
    67 votes
72. A non-privileged user may create an admin account in StockyPrivilege Escalation · medium · Shopify
    67 votes
73. [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in FastlyMisconfiguration · medium · Mozilla
    $50066 votes
74. Login email verification bypass via `/oauth/token`.Missing Critical Step in Authentication · GitLab
    66 votes
75. Two-factor authentication enforcement bypassImproper Authentication - Generic · high · Nextcloud
    $75064 votes
76. Fail-Open in set_tlsext_servername_callback on pyopenssl via unhandled exceptions leads to security bypassImproper Access Control - Generic · low · Python Cryptographic Authority
    63 votes
77. Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassImproper Authentication - Generic · critical · Shopify
    61 votes
78. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · high · X / xAI
    59 votes
79. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium · Automattic
    58 votes
80. Authentication Bypass on https://███████/Improper Authentication - Generic · medium · U.S. Dept Of Defense
    58 votes
81. OneLogin authentication bypass on WordPress sitesImproper Authentication - Generic · Uber
    $10,00058 votes
82. Login Bypass to OTP EnumerationImproper Authentication - Generic · Genasys Technologies
    57 votes
83. Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCImproper Authentication - Generic · high · Nextcloud
    $2,50055 votes
84. bypass two-factor authentication in Android apps and webAuthentication Bypass Using an Alternate Path or Channel · medium · TikTok
    55 votes
85. Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}Improper Restriction of Authentication Attempts · low · X / xAI
    $42055 votes
86. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
87. Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.comCross-Site Request Forgery (CSRF) · high · Ubiquiti Inc.
    55 votes
88. Wallet RPC Restricted-Mode Policy BypassImproper Authentication - Generic · high · Monero
    54 votes
89. Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed LoginsImproper Authentication - Generic · high · WakaTime
    54 votes
90. Basic auth header on WebDAV requests is not bruteforce protectedImproper Restriction of Authentication Attempts · high · Nextcloud
    53 votes
91. Missing ownership check in 2FA for secondary client loginImproper Authentication - Generic · critical · LY Corporation
    52 votes
92. Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypassViolation of Secure Design Principles · low · Brave Software
    52 votes
93. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium · Automattic
    51 votes
94. Email templates XSS by filterXSS bypassCross-site Scripting (XSS) - Generic · high · Judge.me
    $1,25051 votes
95. No Rate Limiting On Phone Number Login Leads to Login BypassImproper Authentication - Generic · medium · Smule
    51 votes
96. Bypass CAPTCHA protectionImproper Authentication - Generic · medium · Rockstar Games
    51 votes
97. Authentication bypass in Global Site Selector allows an attacker to log in as any userImproper Authentication - Generic · critical · Nextcloud
    50 votes
98. iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private TabsImproper Authentication - Generic · medium · Brave Software
    49 votes
99. SQL injection in https://demor.adr.acronis.com/ via the username parameterSQL Injection · high · Acronis
    49 votes
100. Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)Cross-site Scripting (XSS) - Stored · critical · Essity
     48 votes