When OAuth Bypasses 2FA: Finding an Authentication Misconfiguration

Multi-factor authentication (MFA) is an important security layer that helps protect user accounts even when passwords or other authentication credentials are compromised.

However, enabling MFA does not automatically mean that every authentication method enforces it correctly.

During my security research, I identified a two-factor authentication (2FA) enforcement misconfiguration in target.com that allowed an account configured with Google Authenticator (TOTP) to be accessed through Google OAuth without completing the configured TOTP challenge.

The vulnerability was accepted by the Target team as a valid security issue with Medium severity. I was also awarded a Certificate of Appreciation and featured in the Hall of Fame.

In this article, I'll explain the vulnerability, how I identified it, why it matters, and what developers can learn from it.

👋 Whoami

Hi everyone! I'm Ankit Rathva aka Gujarati Hacker, a security researcher and bug bounty hunter who enjoys finding vulnerabilities in web applications. 🕵️‍♂️🔐

I mainly focus on areas such as:

• 🔐 Authentication & Authorization
• 🚪 Broken Access Control
• 🧠 Business Logic Vulnerabilities
• 🔄 Race Conditions
• 👤 Account Takeover
• 🌐 Web Application Security

For me, bug bounty hunting isn't just about finding a bug. It's about understanding how an application is supposed to work, where its security boundaries are, and what happens when those boundaries are tested in unexpected ways.

I spend a lot of time testing situations where the frontend says one thing, but the backend behaves differently.

1. Understanding the Problem

Before discussing the finding, let's understand the technologies involved.

What is TOTP?

Time-based One-Time Password (TOTP) is an authentication mechanism that generates short-lived verification codes using a shared secret and the current time. Applications commonly integrate it with authenticator apps to provide an additional authentication factor.

What is Google OAuth?

Google OAuth-based sign-in allows users to authenticate through their Google account instead of entering their application's password directly.

Both mechanisms serve different purposes:

• Google OAuth delegates authentication to Google.
• TOTP provides an additional verification factor configured within the application.

The important security consideration is that an application must enforce its own authentication requirements consistently, regardless of which login method a user selects.

2. Vulnerability Summary

The application allowed users to enable Google Authenticator-based TOTP 2FA on their accounts.

However, I discovered that the subsequent Google OAuth login flow did not enforce the configured TOTP challenge.

As a result, an account with TOTP enabled could be accessed through the Google OAuth authentication flow without entering the configured authenticator code. Vulnerability type: Improper enforcement of multi-factor authentication Severity: Medium — as assigned by the program Status: Accepted Reward: Hall of fame + Certitificate of recognition

3. How I Discovered the Vulnerability

I followed this testing process using an account I controlled.

Step 1: Authenticate Using Google

I created an account using Google OAuth and confirmed that I could access the application normally.

Step 2: Enable TOTP-Based 2FA

I navigated to the account's security settings and enabled Google Authenticator.

I completed the setup process and verified that the application indicated that 2FA was enabled.

Step 3: Log Out

After confirming the configuration, I logged out of the application to begin a fresh authentication session.

Step 4: Authenticate Through Google OAuth Again

I initiated another login using the same Google account.

Step 5: Observe the Authentication Behavior

The application granted access to the account without requesting the configured TOTP code.

This behavior indicated that the Google OAuth authentication flow was not enforcing the additional verification requirement configured within the application.

The finding was not simply that Google OAuth allowed authentication. The security concern was that the application's own TOTP requirement was not enforced consistently across authentication methods.

4. Why Is This a Security Issue?

Multi-factor authentication is designed to provide an additional layer of protection beyond the primary authentication mechanism.

When an application allows one authentication flow to bypass a configured second factor, the effective protection offered by that factor is weakened.

Consider an application that supports multiple authentication methods:

• Email and password
• Google OAuth
• Microsoft OAuth
• Passkeys
• Other identity providers

If the application enforces MFA during password-based authentication but fails to enforce it during another supported login flow, its authentication policy becomes inconsistent.

The security of the account then depends on the behavior of the individual login flow rather than on a centrally enforced authentication policy.

5. Potential Impact

The impact depends on the application's authentication architecture and the conditions under which an attacker can authenticate.

In this case, the identified issue allowed access through the Google OAuth flow without completing the application's configured TOTP challenge.

Potential consequences include:

• Weakened account protection: The configured TOTP factor does not provide the intended additional verification in the affected login flow.
• Inconsistent security enforcement: Different authentication methods apply different security requirements.
• Increased account-compromise risk: If an attacker can successfully authenticate through the affected flow, the missing TOTP challenge may remove an expected barrier to account access.

It is important to distinguish bypassing an application's TOTP challenge from compromising the user's Google account. The finding concerned the application's failure to enforce its configured second factor; it did not, by itself, demonstrate a compromise of Google's authentication system.

6. Acknowledgment

I would like to thank the security team for reviewing my report, validating the issue, and recognizing my contribution to improving the application's security.

The report was accepted as a Medium-severity vulnerability, and I received a Certificate of Appreciation and recognition in the Hall of Fame.

Responsible disclosure allows security researchers and developers to work together to identify weaknesses before they can be exploited maliciously.

🙏 Thanks for Reading!

If you enjoy practical web application security and bug bounty write-ups, follow me for more vulnerability research, methodology, and real-world findings. 🚀

🔐 Keep Hunting. Keep Learning. Keep Securing.