Security misconfiguration

How it was found

Description :

When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link.

Steps to reproduce :

1. go to app.lemilist.com
2. create a magic link
3. use it to login
4. now open another browser or incognito window
5. use that same magic link

And You'll be logged in in your account.

Impact

If Attacker gets the magic link of user he can login into victim's account. Account takeover.

Mitigation :

1. Add a limit to magic link and remove the magic link from database after 1 use.
2. only allow the Requester IP to login using the magic link.