MFA Bypass via Response Tampering

Multi-factor authentication only helps if the server makes the trust decision. A common flaw: the verification result is influenced by something the client controls.

How it works

• Request tampering: the verify request carries a flag like {"verified":true} or {"mfa":"pass"} that the server trusts instead of checking the OTP.
• Response tampering: the client-side flow reads a verify response ({"success":false}), and flipping it to true advances a poorly designed multi-step UI whose final step doesn't re-check the factor.
• State confusion: the server marks the session "MFA satisfied" before validating the code.

How to test

Intercept the verify call. Try submitting without a code, with an empty/zero code, and by adding verified=true-style fields. Tamper the response body if the next step trusts it. Success despite an unknown OTP is the finding.

Impact

Complete MFA bypass — password alone (or a phished password) becomes full access.

Defenses

• Make the server verify the OTP and set the authenticated state only on success.
• Never accept client assertions of MFA status; re-validate at each step boundary.