SecDim Challenge Builder Repro — Assurance Drift

Working reproduction for a proposed security challenge inspired by CVE-2026-88861, published 10 September 2026.

Security concept

The application correctly verifies a signed session and correctly checks the admin role, but it collapses two independent security properties: identity/role and authentication assurance. A password-only aal1 session can call a privileged credential-creation path that should require step-up MFA (aal2). The resulting app-scoped admin key is durable and remains usable after the original session is logged out.

This models a realistic MFA-bypass failure at the authorization boundary, rather than a broken signature or forged token.

Working repro

go test -v ./...

The tests demonstrate the complete local attack chain:

1. obtain a valid, signed password-only admin session (aal1);
2. use the vulnerable authorization path to mint a privileged API key;
3. log out the original session;
4. continue performing privileged actions with the minted key.

No external service, credential, or production target is involved.

Intended challenge shape

• Stack: Go, standard library only
• Suggested difficulty: intermediate / advanced
• Primary lesson: MFA is an authorization property for sensitive operations, not merely a login UI step.
• Learner task: preserve role checks, session revocation and normal user behavior while enforcing step-up assurance at every durable privilege-escalation boundary.
• Hidden-test directions: independent role-vs-AAL checks, stale/revoked sessions, downgraded sessions, key creation/rotation, malformed assurance claims, and ensuring AAL2 does not accidentally grant admin role.
• Why it is non-trivial: the token is valid and correctly signed; the role is valid; the failure is semantic and occurs after authentication succeeds. Fixes that merely strengthen token verification, add MFA at login, or check only the role still fail the security contract.

Mapping

• CWE-288 — Authentication Bypass Using an Alternate Path or Channel
• CWE-287 — Improper Authentication
• OWASP A07:2021 — Identification and Authentication Failures
• OWASP API5/API6 themes — function authorization and sensitive business flows

Grounding

The scenario is inspired by the assurance-level enforcement failure described for CVE-2026-88861 (Capgo/Supabase AAL1 session bypassing MFA on a privileged RBAC path). This reproduction is original, reduced, and self-contained; it does not copy the affected project.

Remediation demonstrated

secureCreatePrivilegedAPIKey requires both admin authorization and aal2 step-up assurance, while activePrincipal independently enforces session revocation. The tests intentionally verify that neither condition substitutes for the other.