Enforced SSO bypass through an alternate login path
A protected tenant requiring federation remains accessible through a local or alternate authentication path outside the documented exceptions.
Candidate CWE: CWE-288
Test hypothesis#
Use a disposable tenant and recovery administrator. Establish normal federated access, enable its enforcement policy, then try each observed password, magic-link/reset, or alternate-client entry once with a controlled member. Request one synthetic private tenant object; compare the normal federated and logged-out controls.
Evidence required#
Saved tenant enforcement setting, applicable exceptions, actual authentication method/session, exact alternate entry point, and protected tenant access.
Rule out false positives#
Login to an account shell without access to the protected tenant, documented break-glass administrators, or independently scoped service credentials may be intended.
Playbook and command references#
- Authentication, recovery, federation, and session lifecycle — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- OAuth, OIDC, and SAML: transaction binding and token trust — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
- REST, GraphQL, gRPC, WebSocket, and SSE permission parity — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.