2FA bypass through flow and response manipulation
Test skipping the OTP step, replaying a success response, and whether backup codes or remember-me tokens are weaker.
Tag: auth-bypass
JWT header injection via jku and x5u
If the verifier fetches the key from a URL in the token header, point it at your own JWKS and sign with your matching key.
JWT algorithm confusion, RS256 to HS256
A generic verify that does not pin the algorithm lets you sign HS256 tokens using the RSA public key as the HMAC secret.
NoSQL operator injection for auth bypass
When JSON bodies flow into a Mongo query unfiltered, operator objects turn a login into an always-true match.