---
name: validate-authentication-bypass
description: Evidence bar for an authentication bypass into an account or role, and for a bypass into an admin panel or web UI the browser-console snippet that logs the triager in as the bypassed user. Use when validating a finding that claims a login, session, SSO, MFA or role check can be bypassed; for takeover of a chosen account with no victim action, use `validate-zero-click-account-takeover`.
---

# Validate authentication bypass

- Begin from a fresh unauthenticated or lowest-privilege attacker state and use researcher-controlled victim accounts. Do not rely on a victim password, session, token, inbox, device, or authenticated browser unless obtaining that access is itself part of the demonstrated chain.
- Complete the flow through issuance of a target-accepted session or credential and verify it using stable target-derived account identity or role-only data. A forged assertion, reset message, token-shaped value, redirect, or success response alone is insufficient.
- Limit claimed account and role access to what the target-derived session evidence establishes. Keep the victim identifier or target role explicit in the documented inputs.
- Use the `validate-zero-click-account-takeover` skill when the finding claims takeover without victim interaction or prior victim access.

## Admin panel or other web UI

When the bypass reaches an admin panel or another part of the application's web UI, the attached reproducer is a browser-console JavaScript snippet, `<name>.js`, instead of a Python PoC. The triager pastes it into the developer console on the target and ends up genuinely logged in to the application as the bypassed user.

- **The login must be real.** The snippet performs the bypass against the server and obtains a session the server accepts, as the application's own login would:
  - send the bypass requests with `fetch(..., {credentials: "include"})` from the target origin, so the browser stores any session cookie the server sets, HttpOnly ones included;
  - when the server returns a token instead, store it exactly where the application's own login keeps it (the same cookie, `localStorage` or `sessionStorage` key), found by watching a normal login.
- Never fake the login: do not set client-side flags such as `isAdmin`, bypass route guards, stub API responses, or render pages without a server-accepted session.
- After logging in, the snippet calls an endpoint only the bypassed user can read, such as the current-user or an admin-only API, logs the identity and role it returns, such as `Logged in as admin@<target> (role: admin)`, then navigates to the admin panel. On failure it logs which step failed and why, and stops.
- Write one self-contained `(async () => { ... })()` block with no external scripts, the inputs as constants at the top (the target user or role, any identifier), and the identifying header on its `fetch` calls.
- Name the page to run it on: the origin whose cookies or storage the application uses, opened in a private window that is not logged in. When the session lives on another origin, such as an API subdomain, run it there.
- Only view the admin panel; do not change its settings, users or data.
- Before publishing, run the snippet yourself in `agent-browser` from a fresh session, reload, and confirm the admin panel loads the server's data as the bypassed user. Capture the admin panel with the `document-finding-screenshots` skill.
- When the engagement requires a PoC video, the recorder runs only `uv run` commands. Attach a Python PoC that performs the same bypass and prints the identity and role, and give the snippet inline in the steps instead.

Write the replication steps as:

```
1. Open https://<target>/<page> in a private window, without logging in.
2. Open the browser's developer console, paste the attached `<name>.js` (below), and press Enter:

   <the snippet, in a javascript block>

3. The console prints:

   <verbatim console output>

   and the browser opens https://<target>/admin as <user>:

   <admin panel screenshot>
```

Follow them with manual reproduction: the raw bypass request or requests and the response that issues the session.