A technique in which an attacker places an intermediary between a user and the legitimate service to relay credentials and session data in real time. The user completes MFA, but the attacker captures the authenticated session and can often act as the user without repeating the challenge.
What Reverse Proxy MFA Bypass Is
reverse proxy mfa bypass is a real-time relay attack, often called adversary-in-the-middle phishing, where an intermediary sits between the user and the legitimate service, captures the authenticated session, and reuses it before the session expires.
The key point is that the attacker does not need to defeat the MFA challenge directly. Instead, they let the victim complete it normally, then steal the resulting session cookie or token so the service treats the attacker as already authenticated.
How the Technique Works
This technique usually depends on convincing the user to sign in through an attacker-controlled proxy that forwards requests to the real site. Because the login flow still reaches the genuine identity provider, the user sees a believable experience while the proxy collects credentials, MFA assertions, and session material.
Reverse proxy kits are effective because many web services separate authentication from session continuity. Once the browser receives a valid session token, the attacker can often continue the session without needing the password, OTP, or push approval again. That is why session theft is often more operationally important than the initial credential capture.
NHIMG’s MFA Guide explains the relay, fatigue, and token-theft patterns that undermine ordinary MFA flows, while Passwordless and Passkeys Guide shows why phishing-resistant methods change the attack surface materially.
Where It Fails Users and Defenders
Reverse proxy MFA bypass succeeds when defenders assume MFA alone is enough to prove the integrity of the session. In practice, the weakness is often not the factor itself but the fact that a valid session can be replayed after the factor has already been satisfied.
Service-side protections matter because the attacker is exploiting trust in the authenticated browser session, not just password weakness. Controls that reduce session lifetime, bind tokens more tightly, or use phishing-resistant authenticators make relay attacks harder to execute at scale.
For a concrete example of session theft defeating MFA, see CitrixBleed exploitation 2023, where stolen session cookies let attackers skip the login ceremony altogether.
Common Attack Scenarios
Reverse proxy MFA bypass is especially useful against remote access portals, SaaS sign-ins, and any workflow where the browser receives a reusable session artifact after login. The technique is also attractive when attackers want to move quickly from one authenticated session to account takeover, internal access, or data theft.
It often appears alongside credential phishing, MFA fatigue, and session hijacking. The proxy can capture the first login, but the real value comes from preserving the authenticated state long enough to act before the victim notices or the session is revoked.
In a high-impact incident like Change Healthcare breach 2024, a single remote-access session without strong MFA safeguards was enough to open the door to major downstream damage.
Risk and Threat Considerations
Reverse proxy MFA bypass is dangerous because it turns a successful login into a reusable foothold. The attacker can inherit the victim’s authenticated state, bypass normal challenge prompts, and sometimes persist until the session expires or is explicitly invalidated.
Failure mechanism: The attacker relays the victim’s authentication in real time, captures the resulting session artifact, and reuses that artifact to impersonate the user against the legitimate service.
Impact: Account takeover, lateral access into connected systems, and sensitive data exposure can follow even when MFA was completed correctly by the victim.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Session relay attacks defeat organizational user login assurance. |
| IA-5 — Authenticator Management | The technique abuses captured authenticators and session-bearing material. | |
| IA-9 — Service Identification and Authentication | Reverse proxy bypass relies on session trust between services and browser-based access. | |
| Recommendation — Use phishing-resistant authenticators and tighten session controls for organizational user sign-in. Harden authenticator lifecycle and invalidate stolen session material quickly. Bind service sessions more tightly and reduce replay value for captured credentials. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The term maps to phishing-resistant authentication and authenticator assurance guidance. |
| Recommendation — Adopt phishing-resistant authenticators and session protections for higher assurance sign-in. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Relay attacks commonly abuse browser-based federation and token issuance flows. |
| V7 — Session Management | The bypass succeeds by stealing and reusing an authenticated session. | |
| Recommendation — Verify OAuth and OIDC flows resist token theft and session replay. Strengthen session binding, expiry, and invalidation to reduce replay risk. | ||
Practitioner Guidance
What to watch for: Focus on phishing-resistant authentication, session binding, and rapid session revocation rather than treating MFA as a single control outcome. Reverse proxy attacks are best resisted when the login ceremony cannot be transparently relayed into a reusable browser session.
Practitioner takeaway: If the session can be stolen after MFA, the control objective was not just authentication, it was authenticated session integrity.