HexBrain

HackerOne · Report #2463069

2fa can't be activated on app.pullrequest.com

Informativestatus
25upvotes
11 Jul 2024disclosed

How it was found

Summary: Hello Team, Since you are using deprecated google chart API service (which doesn't work now) for generating 2fa qr code image, users cannot setup 2fa for securing account.

Steps To Reproduce

  1. Log into https://app.pullrequest.com
  2. Go to "User Settings" -> "Security" -> "Two-Factor Authentication"
  3. You cannot when you try enabling it

Impact

I understand it is kinda technical bug. But I decided to report as it literally affects all existing and new users by not allowing them to secure their account.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original