Bypassing Organization-Wide 2FA Enforcement with a Single API Request

الحمد لله الذي عَلَّمَ بالقلم.. عَلَّمَ الإنسانَ ما لم يَعْلَم والصلاةُ والسلامُ على خيرِ مُعَلِّمي الناسِ الخير محمد أما بعد

How Does Organization-Wide 2FA Enforcement Work?

The application provides an organization-level security setting that allows owners and administrators to require all organization members to enable 2FA before accessing the organization.

In other words:

• Organization owners can enable or disable mandatory 2FA.
• Administrators can also manage this setting.
• Members must enable 2FA on their personal accounts before accessing the organization.

The idea is simple: if an organization wants an additional layer of security, nobody should be able to access its resources without enabling 2FA.

Vulnerability Discovery

I started by logging in using my organization owner account.

After exploring the organization settings, I found an option that allows the organization to enforce 2FA for all members.

I enabled it.

Now, let's see what happens when someone tries to access the organization without 2FA.

I logged in using another account that hadn't enabled 2FA.

The application blocked access and displayed a message telling me that I needed to enable 2FA before accessing the organization.

At this point, everything seemed to be working as expected.

What about the backend?

Bypassing 2FA Enforcement Through Direct API Requests

I decided to inspect the application's API requests.

I kept the session authenticated using the account that hadn't enabled 2FA and started sending requests directly to the backend.

And guess what?

The backend continued processing authenticated API requests!

Even though the dashboard explicitly prevented the user from accessing the organization, the same user could still interact with organization resources by sending direct API requests using their session cookies.

So the application was checking the 2FA requirement in the UI, but the backend wasn't consistently enforcing it?

That was my first finding.

But I wanted to see if I could take this further.

The Interesting Part: An Administrator Without 2FA

I started thinking about the organization-level setting itself.

Remember, both owners and administrators can enable or disable mandatory 2FA.

So I created another administrator account and invited it to my organization.

I deliberately didn't enable 2FA on this account.

Then I logged in using the newly created administrator.

As expected, the application prevented me from accessing the organization dashboard and displayed the same message requiring me to enable 2FA.

This account was still an administrator.

And administrators have permission to manage the organization's 2FA enforcement setting.

So I wondered:

What would happen if I tried to disable the organization's 2FA requirement directly through the backend?

Disabling Organization-Wide 2FA Through the API

I inspected the request responsible for managing the organization's 2FA enforcement setting.

I found the following endpoint:

POST /dashboard_api/access_control/enforce_2fa/ HTTP/2
Host: gate.example.com
Cookie: <administrator_session_cookies>
Content-Type: application/json
Accept: application/json
{
  "uid": "<organization_id>",
  "enforce": false
}

POST /dashboard_api/access_control/enforce_2fa/ HTTP/2
Host: gate.example.com
Cookie: <administrator_session_cookies>
Content-Type: application/json
Accept: application/json
{
  "uid": "<organization_id>",
  "enforce": false
}

Notice something?

I'm sending this request using an administrator account that has never enabled 2FA.

The request simply sets enforce to false.

I sent it. And boom!

The server successfully processed the request.

Organization-wide 2FA enforcement was disabled.

The Result

I went back and tested the organization using accounts that hadn't enabled 2FA.

They could access the dashboard normally , No 2FA required.

So let's recap what just happened.

1. The organization owner enabled mandatory 2FA.
2. A new administrator joined without enabling 2FA.
3. The application blocked that administrator from accessing the dashboard.
4. The administrator directly called the access-control API.
5. The backend allowed the administrator to disable mandatory 2FA.
6. Every organization member could now access the organization without enabling 2FA.

And remember: The administrator performing this action had not enabled 2FA themselves.

My Links :

Medium X LinkedIn Bugcrowd HackerOne GitHub blog