Sheer · Report #2337938
Cleartext Transmission of password via Email
Validstatus
lowseverity
$200bounty
84upvotes
22 Apr 2024disclosed
How it was found
Summary:
After successfully signup as a fan, the password was then sent to email by cleartext
Steps To Reproduce:
- After successfully signup as a fan, check the email and see that the password was sent in cleartext, it does not appear in the UI, just F12 and you can see the user password {F3012123}
Impact
If the mail channel was sniffed, the attacker can compromise user accounts easily