HexBrain

Weblate · Report #244287

Password token validation in Weblate Bypass #2

Validstatus
7upvotes
21 Aug 2017disclosed

How it was found

Hi,

I also found the bypass to #229987 and #243842.

Reproduction Steps:

  1. Add multiple emails to an account
  2. Request password reset for all emails
  3. Use the link in each to make the change
  4. All link works!

Shuaib

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original