HexBrain

HackerOne · Report #26395

Notification of previous signed out user leakage.

Informativestatus
2upvotes
1 Sept 2014disclosed

How it was found

This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security.

Steps to reproduce

  1. I logged on to hackerone with my team (@movielee) id.I saw that there were 6 notifications pending.I didnot checked those and logged out.
  2. I logged in to my regular account (@siddiki).And after the login,It was just a glance that the notification box showed 6 in that field.And then it was gone.

I should not get the glance of 6 pending notification of the previously signed out account. I think you will agree on this.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original