--- title: "Authentication, Logic & Architecture Flaws · VORNAC Research" description: "Password-recovery logic flaws, JWT/CORS/TLS architecture issues, the working top-10 business-logic patterns, and how a real intrusion looks in logs vs. test traffic." url: https://www.vornac.com/en/research/application-identity/authentication-and-logic lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/application-identity/authentication-and-logic --- [Research Index](https://www.vornac.com/en/research) / [2 · Application & Identity Security](https://www.vornac.com/en/research/application-identity) / Authentication, Logic & Architecture Flaws Featured · [2 Application & Identity Security](https://www.vornac.com/en/research/application-identity) # Authentication, Logic & Architecture Flaws. Password-recovery logic flaws, JWT/CORS/TLS architecture issues, the working top-10 business-logic patterns, and how a real intrusion looks in logs vs. test traffic. ## Password recovery — recurring flaws - **Predictable tokens.** Reset tokens based on timestamp + user-ID. Test by requesting two resets seconds apart and diffing the tokens. - **Response timing leak.** `POST /forgot-password {email:x@y}` returns 200 in 80ms for non-existent users, 300ms for existing. Username enumeration via timing. - **Body-shape leak.** "We have sent an email" vs "If the address exists, an email has been sent". The first is leaky. - **Token reuse / non-expiry.** Same token works after first use; valid for days, not minutes. - **Second-factor downgrade.** Password reset bypasses TOTP. After reset, user is logged in with no MFA challenge. - **Reset link includes session token.** Sharing the reset link with a co-worker shares the session. - **Host header injection.** `Host: attacker.com` in reset request causes the email to contain a link pointing at attacker. Common in apps that use the Host header to construct the reset URL. ## JWT — common misuses - **alg: none.** Re-sign token with header `{"alg":"none"}` and empty signature. Server accepts if it didn't whitelist algorithms. - **HS256 with RSA public key.** Server expects RS256 but accepts HS256. Attacker uses the public RSA key as the HMAC secret → forges any token. - **Key-ID injection.** `kid` header used in `SELECT key FROM keys WHERE id=?` without parameterization → SQL injection. Or `kid: ../../../etc/passwd` for file read. - **Audience claim ignored.** Token issued for service A accepted by service B with the same signing key. Cross-service replay. - **Expiry ignored.** Token from last quarter still accepted. - **Defense.** Hard-code allowed algorithm. Validate `iss`, `aud`, `exp`, `nbf` explicitly. Reject tokens with unexpected headers. ## CORS misconfigs - **Reflect-and-allow-credentials.** Server reads `Origin`, echoes it as `Access-Control-Allow-Origin`, sets `Allow-Credentials: true`. Any attacker site can read authenticated responses. - **Null origin allowed.** Sandbox iframes and data: URLs send `Origin: null`. Allowing this lets a sandboxed page exfil. - **Subdomain wildcard.** `*.example.com` trusted; attacker takes over a forgotten subdomain → trusted origin. - **Test.** Send request with `Origin: https://attacker.com`. If response contains `Access-Control-Allow-Origin: https://attacker.com` + `Allow-Credentials: true`, it's exploitable. ## API-first pitfalls - **Mass assignment.** `PATCH /user/me {role:"admin"}` accepted because the JSON deserializer binds all fields by default (Rails strong-params off, Spring no DTO). - **GraphQL introspection in production.** `{__schema{types{name,fields{name}}}}` returns the full schema. Find hidden mutations. - **GraphQL query-cost DoS.** Nested query: `{user{posts{user{posts{user{posts{id}}}}}}}`. No depth/cost limit = single request takes down the server. - **Batched mutation auth.** Auth check on single-mutation endpoint, missing on batched-mutation endpoint. - **HTTP method override.** POST with `X-HTTP-Method-Override: DELETE` bypasses a WAF rule that filtered on DELETE. ## Working top-10 business-logic flaws 1. **Negative quantity.** Cart accepts `quantity: -3`; total goes negative; refund issued. 2. **Discount stacking.** Two single-use codes applied via parallel requests. 3. **Step-skipping.** Direct POST to step 5 of a 5-step wizard without completing steps 1–4. 4. **Race-condition double-spend.** Two concurrent withdrawal requests, balance decremented once. 5. **Currency rounding abuse.** Buy 0.0001 BTC repeatedly when rounding favors the user. 6. **Trial-period reset.** Delete account + recreate with same email = new trial. 7. **Authorization at the wrong layer.** UI hides the admin button but the API endpoint doesn't check role. 8. **Cancel after success.** Cancel-order endpoint reverses the inventory deduction but not the discount usage. 9. **Voucher / referral exploit.** Self-referral via two accounts, both get the bonus. 10. **State-machine bypass.** Order goes from PENDING straight to FULFILLED without PAID. **Rule of thumb**Logic flaws don't show up in scanner output. Walk every authenticated role end-to-end at least once, then deliberately try to do each action out of order. That single discipline finds more logic flaws than any tool. Domain [2 · Application & Identity Security](https://www.vornac.com/en/research/application-identity) Tier Featured Engagement phases Business LogicSession MgmtCORS / TLS / JWTAPI SecurityAuthentication Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Common Web Vulnerabilities](https://www.vornac.com/en/research/application-identity/common-web-vulnerabilities) - [Featured Web Attack & Defense — Canonical Reference](https://www.vornac.com/en/research/application-identity/web-attack-defense-canon) - [Featured XSS — Comprehensive Reference](https://www.vornac.com/en/research/application-identity/xss-comprehensive) - [Featured Injection, SSRF & XXE](https://www.vornac.com/en/research/application-identity/injection-and-traversal) - [Reference Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits) - [Background Mobile Platform Security — Android, iOS, macOS](https://www.vornac.com/en/research/application-identity/mobile-platform-security) [Previous note Injection, SSRF & XXE](https://www.vornac.com/en/research/application-identity/injection-and-traversal) [Back to domain](https://www.vornac.com/en/research/application-identity) [Next note Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits) From reference to evidence ## Run this against your own environment.