# Sast Missingauth

Detect missing authentication and broken function-level authorization vulnerabilities...

- Repository: https://github.com/utkusen/sast-skills (1357 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-23
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add utkusen/sast-skills --skill sast-missingauth -g -a claude-code -y`
Codex: `npx skills add utkusen/sast-skills --skill sast-missingauth -g -a codex -y`
Cursor: `npx skills add utkusen/sast-skills --skill sast-missingauth -g -a cursor -y`
Gemini CLI: `npx skills add utkusen/sast-skills --skill sast-missingauth -g -a gemini-cli -y`

## Description

Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Missing Authentication & Broken Function-Level Authorization Detection

You are performing a focused security assessment to find missing authentication and broken function-level authorization vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: **recon** (map endpoints and the permission system), **batched verify** (check authentication and authorization in parallel batches of 3 endpoints each), and **merge** (consolidate batch results into the final report).

**Prerequisites**: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.

---

## What This Skill Covers

### Missing Authentication
An endpoint performs a sensitive action but requires **no login at all**, any anonymous HTTP request can trigger it.

### Broken Function-Level Authorization
An endpoint requires authentication (user must be logged in) but **does not check whether the authenticated user has the required role or permission** to invoke that function. The classic example: a regular user calling an admin-only API.

### What This Skill Is NOT

Do not conflate with:
- **IDOR / Horizontal privilege escalation**: Authenticated user A accessing user B's resource by changing an ID. This skill covers **vertical** privilege escalation and unauthenticated access.
- **JWT weaknesses**: Flawed token signing/verification (covered by sast-jwt).
- **Business logic flaws**: Price manipulation, workflow bypass, these are separate.

---

## Vulnerability Classes

### Class 1: Unauthenticated Sensitive Endpoint
The endpoint modifies data, returns private information, or performs an administrative action, with no authentication required.

```
GET /api/admin/users          → returns full user list, no token needed
DELETE /api/admin/users/5     → deletes a user, no token needed
POST /api/settings/smtp       → updates server config, no token needed
```

The rest: https://github.com/utkusen/sast-skills/blob/HEAD/sast-files/.agents/skills/sast-missingauth/SKILL.md