Security Test: Authenticated route bypass¶

Description¶

Default Severity: low

Authenticated route bypass happens when a part of an application that should be protected from unauthorized access is left open due to flaws in its authentication process. Instead of properly checking if a user is allowed to access sensitive data or perform certain actions, the system mistakenly lets anyone through. This oversight can allow attackers to access restricted areas, steal data, or manipulate functionality they shouldn’t be able to. Often, such vulnerabilities arise from misconfigured security checks, overlooked edge cases, or inconsistent token validations. Developers need to ensure every path and endpoint is thoroughly protected, consistently checking credentials to prevent unintended access.

Configuration¶

Identifier: access_control/auth_bypass

Examples¶

All configuration available:

checks:
  access_control/auth_bypass:
    skip: false # default

Compliance and Standards¶