LY Corporation · Report #1283938
Missing authentication in buddy group API of LINE TIMELINE
Validstatus
mediumseverity
$3,000bounty
47upvotes
27 Dec 2021disclosed
Summary
Due to the bug in authentication logic in LINE TIMELINE buddy group API, it could be possible for an attacker to obtain the authority of another person by manipulating API request headers, which would allow an attacker to inquire and modify the buddy group and buddy group list of another user.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.