Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Improper Authentication - any user can login as other user with otp/logout & otp/login | A user account | Another user's | An authenticated user obtained an OTP token for another user's account by changing the user ID in the logout request. |
| Bypassing Digits origin validation which leads to account takeover | A user account | The attacker's own | A lookalike origin sent a message accepted as coming from the trusted Digits origin, allowing account phone-number linkage. |
| Flickr Account Takeover using AWS Cognito API | A user account | Another user's | An attacker-controlled Cognito identity was treated as the victim’s Flickr account during login. |
| Chained Bugs to Leak Victim's Uber's FB Oauth Token | No account | Another user's | The OAuth flow sent a victim’s token to an attacker-controlled site. |
| [cs.money] Open Redirect Leads to Account Takeover | No account | Another user's | The victim's authenticated session token was sent to an attacker-controlled destination. |
| Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) | No account | Another user's | An unauthenticated caller set a password for an account identified by another user's phone number. |
| Bypass Password Authentication for updating email and phone number - Security Vulnerability | A user account | Another user's | A hijacked authenticated session bypassed password re-authentication to change the account email. |
| Insufficient OAuth callback validation which leads to Periscope account takeover | No account | Another user's | OAuth callback validation allowed a victim's authorization token to reach an attacker-controlled destination. |
| Insufficient validation on Digits bridge | No account | Another user's | A site without the registered app domain bypassed the bridge check and received credentials authorized by the victim. |
| Ability to DOS any organization's SSO and open up the door to account takeovers | A user account | Another tenant's | SSO authentication for one organization resulted in user provisioning into an attacker-controlled organization. |
| Improper Validation at Partners Login | No account | Another user's | The attacker caused a victim's authentication OTP to be sent to an attacker-controlled number. |
| Incorrect authorization to the intelbot service leading to ticket information | Not clear from the report | No object involved | Unspecified authentication boundary; the report does not explain what access was gained. |