Auth Bypass

What is an auth bypass?

Authentication asks "who are you?" Authorization asks "can you do this?" Apps that only check the first suffer from auth bypass. Classic examples:

• /api/orders/:id returns any order for any logged-in user
• An admin dashboard hidden only by URL obscurity
• A settings API that trusts a userId field sent from the client

Why AI-built apps are especially prone

AI tools generate the auth middleware once, see that a logged-in user can reach the endpoint, and declare victory. They rarely generate the second check: "does this specific user own this specific row?"

This is why row level security matters and why IDOR vulnerabilities are rampant in AI-built SaaS apps.

What to check

For every authenticated API route, ask:

1. Who owns this resource?
2. Does the code verify the current user equals the owner?
3. If the owner check runs in the database, is RLS actually enabled?
4. Can a caller substitute someone else's user id in the request body?

See also

• IDOR
• Row level security
• AI code security vulnerabilities