I Found a P0 Auth Bypass by Testing What null Does to BCrypt

While constructing SCIP, a supply chain platform with over 90 Spring Boot REST endpoints, I discovered something unexpected during boundary testing of the authentication process. To my astonishment, java BCrypt.matches(null, hash) returned true. This flaw was not limited to a specific hash, nor was it confined to an obscure edge case.

Any account with a null password field, such as a soft-deleted user or a malformed request, could authenticate with any password input. Standard tests typically verify valid credentials against valid hashes, but this security vulnerability remained undetected because developers rarely test scenarios where the password field itself is missing.

They often assume it's an edge case that is too minor to warrant concern, as it appears the library is designed to handle such situations securely by default. However, the implications of this issue were far greater than a typical bug. Authentication serves as the trust boundary for the entire application. A bypass in this area does not merely compromise a single feature; it undermines the entire security model of the system built upon it.

Thus, a flaw in the authentication system, like in a reporting dashboard, is contained within a specific component. Conversely, a vulnerability in the authentication process poses a significant threat to the entire application. The solution to this issue was straightforward. By implementing a null guard before BCrypt is executed, the problem could be mitigated: java if (password == null || password.isBlank()) { throw new SecurityException(Invalid credentials); } if (!BCrypt.matches(password, hash)) { throw new UnauthorizedException(Invalid credentials); } This fix was discovered and documented, emphasizing the importance of thorough testing beyond just valid credentials.

Writing about AI system architecture and quality engineering on chaitrishodaya.com, my work focuses on exposing real bugs and not merely presenting polished results. In this case, the security aspect, the choice of Java, the Spring Boot framework, and the significance of testing were all critical components of the story.