Enjin · Report #1091403
CSRF Bypassed on Logout Endpoint
Validstatus
lowseverity
19upvotes
17 Jun 2022disclosed
Summary
@er_salil was able to demonstrate that the logout functionality had no CSRF protection which meant that they were able to log another user out by simply having that user submit a POST request to the /logout endpoint.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.