Kaspersky · Report #1195618
No Rate Limit On Forgot Password Page
Validstatus
lowseverity
27upvotes
24 May 2021disclosed
Summary
Reported security issue allowed a potential attacker to abuse the password recovery option on our My Kaspersky portal for mass sending of password recovery messages. This was fixed with a password reset throttling feature to protect our service from its abuse by third parties. Note that this problem is related to our internal services and doesn't require any actions from side of our users.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.