HexBrain

Starbucks · Report #242846

Password Change not notified when changed from settings

Informativestatus
mediumseverity
7upvotes
8 Feb 2019disclosed

How it was found

Hi,

Password change is not notified to the account owner if its made from the account settings. This is very crucial as once the account is compromised, the attacker can change the password without giving any clue to the victim.

Steps to reproduce the issue:

  1. Sign in with a valid username and password to www.starbucks.com
  2. Go to your settings and personal info.
  3. click change your password
  4. Change your password
  5. Looks for notification in your email.
  6. No emails are sent.

Can be reproducible with all valid accounts.

Password changed via the forgot password reset flows are notified while this notification is missing.

Thanks, Karthik

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original