HexBrain

Sheer · Report #2337938

Cleartext Transmission of password via Email

Validstatus
lowseverity
$200bounty
84upvotes
22 Apr 2024disclosed

How it was found

Summary:

After successfully signup as a fan, the password was then sent to email by cleartext

Steps To Reproduce:

  1. After successfully signup as a fan, check the email and see that the password was sent in cleartext, it does not appear in the UI, just F12 and you can see the user password {F3012123}

Impact

If the mail channel was sniffed, the attacker can compromise user accounts easily

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original