Summary
The OAuth2 bearer token returned at login is the raw username string itself. The current_user dependency looks up the user by treating the Bearer token directly as a username lookup key, with no signature, randomness, or expiry verification. Anyone who knows or guesses a valid username can authenticate as that user without ever submitting a password.
Location
- Backend/FastAPI/routers/basic_auth_users.py:81-86
Root Cause
Login endpoint returns {"access_token": user.username} (line 81-84).
The protected endpoint dependency current_user(token) calls search_user(token) (line 57-71), treating the bearer token directly as the username lookup key. No JWT signing, no session store, no password re-verification. The password verification at /login is bypassable because the token is deterministic and forgeable.
CWE
CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication)
Exploitation
- Attacker learns a valid username (e.g., 'mouredev' - exposed in source code and via unauthenticated API endpoints)
- Attacker sends: GET /basicauth/users/me with header Authorization: Bearer mouredev
- current_user calls search_user("mouredev"), returning the user object
- Attacker is now fully authenticated as 'mouredev' without ever providing a password
- Any endpoint protected by Depends(current_user) is now accessible
Impact
Complete authentication bypass. Any user account can be impersonated with only knowledge of the username. Combined with the unauthenticated user enumeration endpoints (separate issue), every account is at risk.
Summary
The OAuth2 bearer token returned at login is the raw username string itself. The current_user dependency looks up the user by treating the Bearer token directly as a username lookup key, with no signature, randomness, or expiry verification. Anyone who knows or guesses a valid username can authenticate as that user without ever submitting a password.
Location
Root Cause
Login endpoint returns {"access_token": user.username} (line 81-84).
The protected endpoint dependency current_user(token) calls search_user(token) (line 57-71), treating the bearer token directly as the username lookup key. No JWT signing, no session store, no password re-verification. The password verification at /login is bypassable because the token is deterministic and forgeable.
CWE
CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication)
Exploitation
Impact
Complete authentication bypass. Any user account can be impersonated with only knowledge of the username. Combined with the unauthenticated user enumeration endpoints (separate issue), every account is at risk.