How to Test for 2FA Bypass in Bug Bounty Programs
Two-factor authentication is only as strong as the server checks that enforce it. Hunters keep finding bypasses where the UI asks for a code but an API still issues a full session after password login alone.
Use your own accounts. Do not attempt to defeat another person's second factor.
Map the MFA state machine
Record every status:
- Anonymous
- Password accepted / MFA pending
- MFA success / full session
- Remembered device / skip windows
- Backup code and recovery flows
Note which cookies, tokens, and headers change between states. The bug is usually “reaching state 3 without completing step 2.”
High-yield tests
Direct endpoint skip: After password login, call a post-MFA resource or session-upgrade endpoint without submitting a code.
Status code / JSON manipulation: If the client unlocks the app when {"mfa":true}, try whether the server already granted a full token. Client-only flags are not vulnerabilities unless the server agrees.
Code reuse and brute force: Confirm rate limits and lockouts on your account only, with program permission. Report weak entropy or missing throttling carefully — avoid noisy attacks.
Backup codes & recovery: Recovery that only checks email may weaken MFA. Account recovery is part of authentication.
Changing MFA settings: Adding or removing factors should require a fresh MFA challenge. Otherwise an attacker with a password session can disable protection.
Race conditions: Parallel requests during enrollment or verification can sometimes create a session before the secret is confirmed. Use small, controlled parallelism on your account.
Session binding
MFA success should bind to the same browser session that started login. Test whether an MFA completion in session A upgrades session B. That pattern shows up in poorly implemented SSO + MFA combinations.
What good evidence looks like
Show password login response, MFA-pending token, the skipped request, and a privileged action that should have been blocked. Two of your accounts are enough when the issue is logic, not code guessing.
Defensive checklist
- Enforce MFA in the session service, not only in the frontend router.
- Issue limited “MFA pending” tokens that cannot call sensitive APIs.
- Require step-up authentication for MFA management.
- Rate-limit verification attempts per account and per IP.
- Invalidate pending login state after failures and timeouts.
People search for “2FA bypass bug bounty” because MFA feels final — until an API forgets to check it. Your job is to verify the server's state machine, not the banner that says “2FA enabled.”
Original Bugflare guide informed by PortSwigger multi-factor authentication labs and guidance.