---
id: 1467
title: "How a GraphQL Bug Resulted in Authentication Bypass"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/how-graphql-bug-resulted-authentication-bypass"
published_at: "2024-07-29 21:00"
tags: ["bug-bounty", "access-control", "authentication-bypass", "privilege-escalation", "api-security", "graphql", "e-commerce"]
phying_url: "https://phying.com/item/1467"
lang: en
---

# How a GraphQL Bug Resulted in Authentication Bypass

## Summary

A researcher abused a GraphQL API with weak access control as an alternate channel to bypass authentication and escalate to admin in an e-commerce app, exposing promo banner and product data.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-07-29 21:00
- **Original:** https://www.hackerone.com/blog/how-graphql-bug-resulted-authentication-bypass
- **Phying News:** https://phying.com/item/1467