Algolia · Report #145629

2-factor authentication bypass

Validstatus

20upvotes

17 Jan 2017disclosed

Summary

Bad 2FA activation flow has been discovered that could lead to user, which would not read the onscreen instructions, thinking the 2FA has been activated before it really did.

2FA is enabled unless the setup process is completed

How it was found

Hello aligola team,

there are 2-factor authentication bypass while login

Steps=> 1.made 2-factor authentication in your account 2.login to your account 3.you will see that your account is already opened without do 2-factor authentication

POC video attached

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original