Lab: Authentication bypass via flawed state machine
Summary: PortSwigger's Web Security Academy lab describes a login flow that assumes users complete each step in order: after the POST /login request, the next request is GET /role-selector, where the user picks a role before reaching the home page. Dropping that role-selector request and browsing to the home page causes the account's role to default to administrator, giving access to the admin panel and the ability to delete the user carlos.
Key Takeaway: The bypass needs no exploit payload, only a skipped step: when a role assignment is left to a default rather than set explicitly, an unprivileged account can land in the administrator role by omitting one request.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026