HexBrain

Starbucks · Report #193478

Create New User Whilst Logged On

N/Astatus
4upvotes
13 Jan 2017disclosed

How it was found

The website www.teavana.com allows users already logged on to create new account with a very simple url redirect. When an account is created a page is displayed with your account information and what you want to update. By simply refreshing the page allows you to create a new account whilst still logged on. If you try to recreate the same account with the same email but different password, there will be no error message displayed though when you try to login, the password will be incorrect.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original