UPchieve 路 Report #1166500
Zero click account Takeover due to Api misconfiguration 馃弬馃帺
Validstatus
criticalseverity
37upvotes
14 May 2021disclosed
Summary
Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible.
i was able to take over any account without any action from the user
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.