bitaccess · Report #159497
Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error.
Validstatus
4upvotes
21 Nov 2016disclosed
Summary
Due to a bug on session management, Rate limit was not properly applied to some functionalities on the website, which let a bad actor to send unlimited password reset emails by bypassing the Recaptcha rate limit.
This was not a security issue, fixed to prevent spamming users.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.