HexBrain

Legal Robot · Report #259416

Incorrect email content when disabling 2FA

Validstatus
5upvotes
15 Aug 2017disclosed

How it was found

Hello @team,

I found that there is false statement in the 2FA disabled mails sent by the legalrobot.

what is the issue? When user is disabling the 2fa authenticator app Registration.He will get a notification regarding the Disabling of the 2FA .the mail structure is like this: ** 2FA disabled

The 2FA Authenticator App registration was just removed from your Legal Robot (TEST) account. 2-Factor Authentication is still enabled since you registered a security key.

**

but the user haven't registered any security key.

steps to reproduce: 1.Create a new account. 2.login to your account and enable the 2FA authentication. 3.dont make any changed to the FIDO U2F Security Key . 4.disable the 2FA Authenticator App registration. 5.now you will receive mail from legalrobot updating about the 2FA disabled. 6.but still you can find the statement " 2-Factor Authentication is still enabled since you registered a security key."

This will create confusion among the users and the trust will break.

Kindly find the attached video poc for better understanding.

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original