Docs / Checks / Security

Updated July 31, 2026 · Security · High severity

Admin routes and health endpoints reachable without login

Seen in 17 of 450 scanned projects (4%). based on unauthenticated route probes across audited production deployments

Common stacks: nextjs node express nginx caddy pm2

How to tell you have it

Why it matters

When the only thing standing between a stranger and your admin panel is a React component that conditionally renders a login form, the actual HTML and any data embedded in it were already sent to the browser before that check ran. Anyone with the URL, or anyone who finds it in a sitemap, a JS bundle, or search engine cache, sees the real page. Client-side auth is a UI convenience, not a security boundary.

Debug and health routes are frequently left wide open because they were added for local development and never revisited before deploy. A `/health` or `/status` endpoint that dumps process uptime, database connection strings, internal IPs, or a stack trace on error is a reconnaissance gift to anyone scanning the internet for exactly that pattern. Automated bots do this scanning continuously, not just targeted attackers.

Publish, delete, and settings toolbars that check a role only in the frontend leave the underlying API route unguarded. A user just needs to replay the request with curl or Postman, skipping the UI entirely, to trigger the same server action a logged-in admin would. This turns a cosmetic restriction into a full authorization bypass.

Binding a service directly to 0.0.0.0 instead of 127.0.0.1 means it answers on every network interface, including the public one, even when you intended a reverse proxy to be the only entry point. Combined with no auth check, this exposes admin functionality, metrics, or an entire framework's debug console to the open internet with zero warning in the logs until something goes wrong.

How Heygents detects it

How to fix it

1. Prove the route is actually open Run an unauthenticated request against the suspect path from a machine that has never logged in. A 200 with real content, not a redirect to /login or a 401/403, confirms the gate is missing on the server.
2. Add a server-side auth gate in middleware Move the check out of any page component and into middleware or a server handler that runs before rendering, so the response itself never leaves the server without a valid session.
3. Verify the session server-side, not just its presence A cookie existing is not proof it is valid. Decode and verify it against your session store or JWT secret on every admin request, and reject expired or tampered tokens with a 401.
4. Strip internals from health and debug endpoints Health checks should return a minimal ok/fail status for load balancers, nothing else. Move any diagnostic detail behind the same auth gate as the rest of the admin surface.
5. Bind internal services to localhost, not 0.0.0.0 If a reverse proxy like Caddy or nginx is meant to be the only public entry point, the app process behind it should listen on 127.0.0.1 so it is unreachable directly from the internet even if a route-level check is ever missed.

Prove the route is actually open

curl -sI https://example.com/admin
curl -sI https://example.com/health
curl -s https://example.com/admin | grep -i 'dashboard\|logout'

Add a server-side auth gate in middleware

// middleware.js
import { NextResponse } from 'next/server'

export function middleware(request) {
  const session = request.cookies.get('session')
  const isAdminPath = request.nextUrl.pathname.startsWith('/admin')

  if (isAdminPath && !session) {
    return NextResponse.redirect(new URL('/login', request.url))
  }
  return NextResponse.next()
}

export const config = {
  matcher: ['/admin/:path*', '/api/admin/:path*'],
}

Verify the session server-side, not just its presence

async function requireAdmin(req, res, next) {
  const token = req.cookies.session
  if (!token) return res.status(401).json({ error: 'unauthorized' })

  try {
    const payload = verifySession(token)
    if (!payload.isAdmin) return res.status(403).json({ error: 'forbidden' })
    req.user = payload
    next()
  } catch (err) {
    return res.status(401).json({ error: 'unauthorized' })
  }
}

app.use('/api/admin', requireAdmin)

Strip internals from health and debug endpoints

app.get('/health', (req, res) => {
  res.status(200).json({ status: 'ok' })
})

app.get('/api/admin/debug', requireAdmin, (req, res) => {
  res.json({ uptime: process.uptime(), queueDepth: getQueueDepth() })
})

Bind internal services to localhost, not 0.0.0.0

# pm2 / process env
HOST=127.0.0.1 PORT=3000 pm2 start server.js --name <app>

# confirm it is not on the public interface
ss -tlnp | grep 3000

Frequently asked questions

Is hiding the admin link enough if there is no way to guess the URL?

No. Obscurity is not a control. URLs leak through browser history, analytics tools, JS bundle source maps, server logs shared with third parties, and search engine crawlers that follow any link they find. Treat every route as discoverable and gate it on the server regardless of how hard the URL is to guess.

Does putting the admin panel behind a VPN replace the need for login checks?

A VPN reduces exposure but should not be the only control. VPN credentials get shared, laptops get stolen, and misconfigured routes still get exposed if the VPN itself has a gap. Keep server-side session auth as the primary gate and treat network restriction as a second, independent layer.

Why does a redirect to /login in the browser not mean the route is protected?

A client-side redirect happens after the page's JavaScript has already loaded and, in many frameworks, after the initial HTML and any embedded data were already delivered by the server. A curl request with no browser and no JS execution will get the raw response, which is what actually matters for security, not what the browser displays after the fact.

What is the fastest way to check every route in a project for this issue?

List every path defined in your router or API folder, then loop a plain curl with no cookies over each one and flag any response that is 200 with real content instead of a redirect or 401/403. Pay particular attention to health, debug, status, and admin prefixes since those are the most commonly forgotten.