Authentication Bypass

Search for jwt.verify and jwt.decode calls, then check whether algorithms are explicitly restricted, secrets are hardcoded or weak, and tokens have expiration set. Accepting the 'none' algorithm or omitting the algorithms option allows algorithm confusion attacks.

Locate reset token generation and check for predictability, reuse, expiry, rate limiting, and email enumeration. Tokens derived from user data like MD5 of an email are predictable; use cryptographically random tokens such as secrets.token_urlsafe.

Check redirect_uri validation for open redirect injection, presence of the state parameter to prevent CSRF, client secrets exposed in frontend code, token leakage via URL fragments, and scope escalation beyond intended permissions.

Yes, the grep patterns target JavaScript, TypeScript, Python, Ruby, and Java files. The checks for JWT, sessions, cookies, and reset tokens apply across frameworks since they search for common library and pattern names.

Common bypasses include missing rate limiting on OTP attempts enabling brute force, predictable backup codes, race conditions submitting login and 2FA simultaneously, and accessing post-login endpoints directly to skip the 2FA step.