HexBrain

WakaTime · Report #245305

Two email addresses can access the same account

Validstatus
10upvotes
3 Jul 2017disclosed

How it was found

Hello Team,

When I was testing your web application I found that we can change the email address to a new email address. I tested that feature and noticed that after changing the email to a new email and then back to the old email, I can still access the account using both the email addresses.
Doing so doesn't allow the email holder of the second email address to create an account on Wakatime using the same email address, as the error shows that the email address has already been taken. I presume that this can be done for a number of emails as I haven't tested that yet. One account clearly shouldn't be accessible by 2 email address and is a violation of secure design principles.

Let me know if you need anything else.

Best Regards, Streaak2

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original