Browse / Bypasses / Email and phone verification

Getting past email and phone verification

Confirming an address or number before it is trusted. 48 disclosed reports got past one.

1. Takeover an account that doesn't have a Shopify ID and morecritical · Shopify
   3,006 votes
2. Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOPrivilege Escalation · critical · Shopify
   1,922 votes
3. [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationPrivilege Escalation · critical · Shopify
   894 votes
4. Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationPrivilege Escalation · critical · Shopify
   559 votes
5. Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationImproper Access Control - Generic · medium · Shopify
   310 votes
6. Ability to bypass partner email confirmation to take over any store given an employee emailTime-of-check Time-of-use (TOCTOU) Race Condition · critical · Shopify
   $15,250273 votes
7. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high · GitLab
   $3,000257 votes
8. Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainReliance on Untrusted Inputs in a Security Decision · medium · GitLab
   249 votes
9. Able to bypass email verification and change email to any other user email Improper Access Control - Generic · high · Reddit
   $5,000200 votes
10. Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"Improper Authorization · critical · Insightly
    148 votes
11. Email Verification bypass on signupViolation of Secure Design Principles · high · Automattic
    127 votes
12. 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationImproper Access Control - Generic · critical · Khan Academy
    126 votes
13. Insecure Invitation Link Handlingmedium · ProductBoard, Inc.
    93 votes
14. Bypass Email Verification on Add Email MonitoringInformation Disclosure · medium · Mozilla
    93 votes
15. Bypass Email verification for monitoring at `monitor.mozilla.org`Business Logic Errors · medium · Mozilla
    85 votes
16. Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone VerificationImproper Access Control - Generic · low · TikTok
    84 votes
17. Email Verification Bypass via Race ConditionImproper Authentication - Generic · Malwarebytes
    70 votes
18. email verification bypassImproper Authentication - Generic · medium · Algolia
    67 votes
19. Login email verification bypass via `/oauth/token`.Missing Critical Step in Authentication · GitLab
    66 votes
20. Bypass SMS verification to delete TikTok accountImproper Authorization · low · TikTok
    64 votes
21. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
22. Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log InImproper Authentication - Generic · medium · Enjin
    48 votes
23. Bypass Email Verification in Customer PortalImproper Access Control - Generic · low · Mattermost
    45 votes
24. Email not verified when changing afterwards on apps.nextcloud.comViolation of Secure Design Principles · low · Nextcloud
    42 votes
25. Email Verification Bypass Allows Users to Add & verify Any Email As Guardians Email Privilege Escalation · high · Khan Academy
    42 votes
26. Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interactionImproper Authentication - Generic · high · Automattic
    41 votes
27. Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data ExposureImproper Access Control - Generic · medium · Trellix
    40 votes
28. e-mail verification bypass through interception & modification of response statusViolation of Secure Design Principles · U.S. General Services Administration
    26 votes
29. Bypassing 2FA with conventional session management - open.rocket.chatImproper Authentication - Generic · low · Rocket.Chat
    25 votes
30. Email Verification Bypass by bruteforcing when setting up 2FAImproper Restriction of Authentication Attempts · low · Evernote
    $15023 votes
31. Email verification bypassed during sing up (████████)Violation of Secure Design Principles · medium · MTN Group
    20 votes
32. Bypassing creation of API tokens without email verificationImproper Authentication - Generic · low · Cloudflare Public Bug Bounty
    19 votes
33. Bypass email verification and create email template with the editorImproper Access Control - Generic · high · Stripo Inc
    18 votes
34. rubygems.org Batching attack to `confirmation_token` by bypass rate limitImproper Restriction of Authentication Attempts · low · Internet Bug Bounty
    $48011 votes
35. Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN matchBusiness Logic Errors · curl
    10 votes
36. User Information leak allows user to bypass email verification.Violation of Secure Design Principles · Legal Robot
    9 votes
37. Authentication Bypass - Email Verification code bypass in account registration process.Improper Authentication - Generic · critical · UPchieve
    8 votes
38. ByPassing the email Validation Email on Sign up process in mobile appsViolation of Secure Design Principles · Coinbase
    $1007 votes
39. Recently change email but still login with old emailImproper Authentication - Generic · high · Nextcloud
    6 votes
40. TLS host identity verification bypass via session reuse with different servername leads to unauthorized connectionsExploiting Incorrectly Configured SSL/TLS · medium · Node.js
    5 votes
41. Email verification bypasaIncorrect Authorization · high · Stripo Inc
    5 votes
42. Bypassing Phone Verification For Posting AD On OLXImproper Authentication - Generic · OLX
    5 votes
43. Account Confirmation bypass leads to acess some fucntionality Improper Access Control - Generic · medium · Acronis
    4 votes
44. Bypass email verification when register new accountImproper Access Control - Generic · Legal Robot
    4 votes
45. Email Verification Bypass And Get access to user's private invitation.Business Logic Errors · medium · Reddit
    3 votes
46. Bypass Email Verification.Improper Access Control - Generic · Doppler
    3 votes
47. my.stripo.emai email verification bypassed and also create email templatesReliance on Untrusted Inputs in a Security Decision · medium · Stripo Inc
    3 votes
48. Bypassing Email verification Improper Access Control - Generic · Vimeo
    2 votes