Valve · Report #2270633
Web API key registration allows registering multiple keys by reusing `request_id`
Validstatus
lowseverity
40upvotes
12 Dec 2023disclosed
Summary
The Steam API key registration now requires a confirmation via the mobile authenticator. The request_id, once correctly confirmed, was not correctly updated and could be used more than once to register keys for the given account.
The registration process is now fixed, and accounts with multiple registered keys have been corrected.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.