HexBrain

Cloudflare Public Bug Bounty · Report #1675730

Password Policy Restriction Bypass

Validstatus
lowseverity
11upvotes
30 Sept 2022disclosed

Summary

Due to insufficient input validation on the backend side, It was possible to bypass the Password Policy Restrictions for Cloudflare accounts by intercepting the request and modifying the content of the password field. This way, a user could set up weak passwords for their account. The password policy restrictions were updated in the backend to match frontend side validation rules.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original