Overview
Where MFA is present, testing whether it is correctly enforced and bypass-free is a valuable bug bounty activity. This lesson covers MFA testing.
Learning objectives
- Identify MFA weaknesses to hunt for.
- Explain testing MFA enforcement safely.
- Connect MFA bypasses to impact.
Core concept
MFA testing checks whether a second-factor requirement is correctly enforced with no bypasses (building on the earlier MFA lessons). Even when MFA exists, flaws can undermine it: the MFA step might be skippable (via flow manipulation or endpoints that bypass it), MFA might not be enforced on all authentication paths (e.g. an API or legacy login that skips it), or recovery/reset flows might circumvent MFA. A bypass — reaching an authenticated state without the second factor — is a high-impact finding. Testing uses test accounts and focuses on enforcement completeness, not attacking real users' factors.
How it works
Using test accounts with MFA enabled, the researcher verifies MFA is enforced wherever authentication occurs and cannot be bypassed: checking that the post-password MFA step can't be skipped by manipulating the flow, that alternate login paths (APIs, mobile, legacy) also require MFA, and that recovery flows don't provide an MFA-free way in. The goal is to confirm the presence and completeness of enforcement — a path reaching authentication without the second factor is a bypass finding. Testing never targets real users' second factors; it examines the application's enforcement using the researcher's own test accounts, per program rules.
Practical example
Testing an in-scope application with MFA on test accounts, the researcher confirms the web login enforces the second factor, then checks the API login path — finding it authenticates with only a password, bypassing MFA. This inconsistent enforcement is a high-impact finding, documented with a fix (enforce MFA across all login paths). The researcher tested enforcement completeness using their own test accounts, never attacking real users' factors — a responsible, valuable MFA finding.
Cybersecurity relevance
MFA bypasses are high-impact bug bounty findings because MFA is a key control — an implementation that can be skipped (via an alternate path, flow flaw, or recovery) gives false assurance and can enable account takeover despite MFA. Common issues include inconsistent enforcement across login paths and MFA-circumventing recovery flows (mapping to the ethical-hacking MFA-testing lesson). Testing verifies enforcement completeness using test accounts, per program rules — never attacking real factors. For defenders, findings drive consistent, bypass-free MFA. It is a valuable, responsibly-tested area.
Common mistakes
- Assuming MFA on the main login means it's enforced everywhere — check all paths (API, legacy, mobile).
- Overlooking recovery/reset flows that bypass MFA.
- Attacking real users' second factors instead of testing enforcement with test accounts.
Key takeaways
- MFA testing verifies the second factor is correctly enforced with no bypasses — across all login paths and recovery flows.
- Common weaknesses: skippable MFA steps, inconsistent enforcement (API/legacy paths), and MFA-circumventing recovery.
- Bypasses are high-impact; test enforcement completeness with test accounts (never real factors), per program rules — findings drive consistent, bypass-free MFA.
Check your understanding
- Why must MFA enforcement be checked on all authentication paths, not just the main login?
- How can a recovery flow undermine otherwise-correct MFA?