Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations

Resecurity identified a critical authentication bypass in a yard management system where the application used a stateless signed cookie that contained the user's public CUID as its payload and was HMAC-signed with a hard-coded, predictable secret ("session_secret_example"). By harvesting user IDs from exposed API endpoints and performing an offline candidate search (~110 candidates) to recover the signing key, testers forged valid session cookies and impersonated 95 distinct employee accounts—including administrators—allowing read/write and administrative actions while bypassing Entra ID SSO, MFA, and RBAC; recommended fixes include rotating and strengthening secrets, using random server-side session IDs backed by a session store, and invalidating existing sessions.