Cloudflare Public Bug Bounty · Report #1675730
Password Policy Restriction Bypass
Validstatus
lowseverity
11upvotes
30 Sept 2022disclosed
Summary
Due to insufficient input validation on the backend side, It was possible to bypass the Password Policy Restrictions for Cloudflare accounts by intercepting the request and modifying the content of the password field. This way, a user could set up weak passwords for their account. The password policy restrictions were updated in the backend to match frontend side validation rules.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.