auth-bypass-hunter

Request an OTP for a controlled account and inspect the response body and headers for leaked codes, then test whether a session issued before OTP completion can access protected endpoints. Never brute-force values; submit at most one known-invalid code if scope rules permit.

Authentication bypass means the server fails to establish the claimed identity at all, such as accepting a missing or forged token. Privilege escalation means an already-authenticated user exceeds their assigned role, which is handled by a separate privesc-hunter skill.

Positive proof requires an authenticated identity, protected data, or an action attributed to the victim without the required proof. Reject cases like public data on private-labeled routes, cookies blocked on protected endpoints, or 200 responses containing error flags.

Yes, it covers OAuth trusted-app parameter tampering, consent bypass, and token subject verification, plus SAML signature issues via the version boundary table. Check the target's library versions against OSV/GHSA fixed boundaries before testing.

Do not file when the behavior is expected product design, when a control exists elsewhere that blocks the action, when the flaw lacks attacker control, or when impact falls below the program's threshold. Apply the full negative-control taxonomy and the scope and reportability decision split first.