Cloudflare Public Bug Bounty · Report #1664974
Bypass two-factor authentication
Validstatus
lowseverity
$250bounty
34upvotes
4 Oct 2022disclosed
Summary
Due to lack of validation, a malicious actor could brute force OTP 2fa and guess a correct number after multiple failures. The issue was fixed by the Engineering team by implementing restrictions on 2FA attempts.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.