FinishKitAuth Bypass
A vulnerability class where a user can reach, read, or modify resources they should not have access to, usually because the app checks authentication (who you are) but not authorization (what you can do).
Also known asauthorization bypassbroken access control
What is an auth bypass?
Authentication asks "who are you?" Authorization asks "can you do this?" Apps that only check the first suffer from auth bypass. Classic examples:
/api/orders/:idreturns any order for any logged-in user- An admin dashboard hidden only by URL obscurity
- A settings API that trusts a
userIdfield sent from the client
Why AI-built apps are especially prone
AI tools generate the auth middleware once, see that a logged-in user can reach the endpoint, and declare victory. They rarely generate the second check: "does this specific user own this specific row?"
This is why row level security matters and why IDOR vulnerabilities are rampant in AI-built SaaS apps.
What to check
For every authenticated API route, ask:
- Who owns this resource?
- Does the code verify the current user equals the owner?
- If the owner check runs in the database, is RLS actually enabled?
- Can a caller substitute someone else's user id in the request body?