# Auth Bypass

> Hunt authentication/authorization bypass in route guards, role checks, tenant boundaries, and state-machine transitions.

- Skill: `purpleailab/auth-bypass` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/auth-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/auth-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/auth-bypass

---


# Auth Bypass Playbook

## Targets
- Endpoints with role-based access
- Admin-only routes
- Tenant-scoped resources
- Multi-step auth flows (MFA, password reset)

## Common failure patterns
- Missing middleware on one route variant
- Trusting client-controlled role/tenant fields
- TOCTOU between check and action
- Alternate API versions lacking guard checks

## Validation
- Positive: low-priv session performs high-priv action.
- Negative: same request with expected guard path should deny.