Alohi · Report #1584569
Weak rate limit for SIGN.PLUS email verification
Validstatus
lowseverity
3upvotes
21 Jun 2022disclosed
Summary
zeesozee identified a way to reset the rate limit concerning the "Confirm your email" verification endpoint for new accounts. This increases the chance of successful bruteforce from an attacker who would try to register with a fake email. The issue was fixed immediately.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.