Alohi · Report #1482919
Misconfigured rate limit for SMS phone verification endpoint
Validstatus
mediumseverity
26upvotes
10 May 2022disclosed
Summary
One of our rate-limit configurations had a high threshold, allowing attackers to spam request multiple SMS codes (by replicating the network request) to a phone number before getting blocked.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.