Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In

Summary

@alpernae was able to demonstrate that there was no check for email verification, allowing for a user to authenticate into the Enjin Platform without ever having verified their email address. This has been addressed and it is now impossible for a session to be initiated without email verification being completed.

Response manipulation was discovered on the Enjin platform. It is a vulnerability that allows an attacker to manipulate the response to a specific request. Using the victim's email address, the attacker can register without the victim's permission and log in without verifying the email address.