Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

A dual-purpose account endpoint applies weaker checks in one mode, allowing a sensitive operation without the authentication context expected by the other mode.

Lab overview identifies `/my-account/change-password` as a dual-use self-service and administrative reset endpoint.
Lab overview identifies `/my-account/change-password` as a dual-use self-service and administrative reset endpoint.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates weak isolation on dual-use endpoint. The supplied accounts and endpoints are used to reproduce only the source note evidence for weak isolation on dual-use endpoint; all request changes remain inside this Academy instance.

What I observed

The baseline capture for weak isolation on dual-use endpoint establishes the intended request and response before any mutation. Subsequent replays isolate the input or state transition responsible for weak isolation on dual-use endpoint, and the response evidence shows exactly when the lab accepts the unintended behavior.

`POST /my-account/change-password` exposes client-controlled `username`, `current-password`, and new-password fields.
`POST /my-account/change-password` exposes client-controlled `username`, `current-password`, and new-password fields.
Changing `username` to `administrator` while supplying an incorrect current password returns a validation error.
Changing `username` to `administrator` while supplying an incorrect current password returns a validation error.

Why it is vulnerable

Combining privileged and ordinary operations in one handler creates branches with inconsistent authentication requirements.

Walkthrough in the authorized PortSwigger lab

  1. Capture the baseline request for weak isolation on dual-use endpoint and record the response that represents the intended lab workflow.
  2. Replay the recorded mutation that exposes weak isolation on dual-use endpoint, keeping the session and other fields unchanged.
  3. Confirm the weak isolation on dual-use endpoint signal in the response before applying the next source-documented operation.
  4. Complete the Academy objective using only the confirmed weak isolation on dual-use endpoint behavior and the supplied synthetic account or product data.
Modified request targets `administrator` and removes the `current-password` parameter entirely.
Modified request targets `administrator` and removes the `current-password` parameter entirely.
Password-change response accepts the missing-current-password branch and resets the administrator credential.
Password-change response accepts the missing-current-password branch and resets the administrator credential.

Verification

The final capture shows the Academy marking the weak isolation on dual-use endpoint exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Administrator login exposes the admin panel, where deleting `carlos` produces the Academy solved response.
Administrator login exposes the admin panel, where deleting `carlos` produces the Academy solved response.

Impact and defensive lesson

The evidence demonstrates the concrete risk of weak isolation on dual-use endpoint: a server-side trust decision can be bypassed through the exact input or workflow shown in this lab. For weak isolation on dual-use endpoint, the server must enforce the exact invariant violated in the captured sequence and regression-test that mutation alongside the normal path.

References