CRITICAL: Authentication Bypass - Bearer token is raw username, no password required #1478

Summary

The OAuth2 bearer token returned at login is the raw username string itself. The current_user dependency looks up the user by treating the Bearer token directly as a username lookup key, with no signature, randomness, or expiry verification. Anyone who knows or guesses a valid username can authenticate as that user without ever submitting a password.

Location

• Backend/FastAPI/routers/basic_auth_users.py:81-86

Root Cause

Login endpoint returns {"access_token": user.username} (line 81-84).
The protected endpoint dependency current_user(token) calls search_user(token) (line 57-71), treating the bearer token directly as the username lookup key. No JWT signing, no session store, no password re-verification. The password verification at /login is bypassable because the token is deterministic and forgeable.

CWE

CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication)

Exploitation

1. Attacker learns a valid username (e.g., 'mouredev' - exposed in source code and via unauthenticated API endpoints)
2. Attacker sends: GET /basicauth/users/me with header Authorization: Bearer mouredev
3. current_user calls search_user("mouredev"), returning the user object
4. Attacker is now fully authenticated as 'mouredev' without ever providing a password
5. Any endpoint protected by Depends(current_user) is now accessible

Impact

Complete authentication bypass. Any user account can be impersonated with only knowledge of the username. Combined with the unauthenticated user enumeration endpoints (separate issue), every account is at risk.