Lab: 2FA simple bypass
Summary: PortSwigger's Web Security Academy lab shows a two-factor authentication bypass in which a user who has a valid username and password but not the victim's verification code can log in as the victim by manually changing the URL to /my-account when prompted for the code. The lab supplies credentials for a test user (wiener:peter) and a victim (carlos:montoya), and is marked solved once the victim's account page loads.
What's compelling: The bypass works because the application checks the password but not whether the second factor was ever completed, so anyone holding a stolen password reaches the account page by editing a URL. A second factor that a URL change can skip provides no protection against the credential theft it exists to stop.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026