Legal Robot · Report #249337
Non-functional 2FA recovery codes
Validstatus
9upvotes
19 Jul 2017disclosed
Summary
While going live with additional 2FA options, a security researcher discovered that users that had enabled 2FA were not able to recover their accounts in case of a missing phone or authentication device. The issue was caused by improper error handling on the client during account recovery.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.