Legal Robot · Report #191643
Password complexity requirements not enforced
Validstatus
lowseverity
18upvotes
4 Feb 2017disclosed
Summary
A security researcher discovered that password complexity requirements were not being enforced on initial password creation, password change, and password reset. While the page showed the password strength bar, users were still allowed to create very weak passwords.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.