#104 · Authentication bypass / session-token forgery

Any way to act as another user without their credentials, OR to elevate privileges to admin without admin-level OIDC claims.

Likely surfaces

• OIDC PKCE flow in packages/shared-utils/src/auth/ — race conditions in state, code_verifier reuse, missing audience validation
• Session cookie handling — fixation, missing httpOnly/Secure flags, predictable session IDs
• The scoreboard's ADMIN_GROUPS group-name match (case sensitivity, whitespace, missing claim)
• Bot API key validation (verifyBotApiKey) — timing leaks, length-extension
• linked_accounts flow allowing account takeover via Signal UUID swap

Distinct from "lost session"

If you can prove you became another user via something other than that user typing their password, this qualifies. Critical tier.

--- *This is NOT a normal bounty. Do not post a public PoC or a public PR demonstrating the vulnerability. Submit findings via the bug-report form at https://score.irregulars.io/contribute#report-bug, or email security@irregularchat.com, or DM an admin on Signal. Awards are admin-determined based on impact: low=50 / medium=150 / high=300 / critical=500 / rce=750.*