Nextcloud · Report #248656
bypass of 2FA
Validstatus
highseverity
$750bounty
20upvotes
29 Jul 2018disclosed
Summary
Improper protection of the 2FA login made a bypass of the 2FA possible. The bug required to know user credentials but effectively rendered the 2FA ineffective.
The issue has been fixed by the Nextcloud team and has been validated by the reporter.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.