HexBrain

Legal Robot · Report #265749

Bypass email verification when register new account

N/Astatus
4upvotes
4 Sept 2017disclosed

How it was found

Hi Legalrobot,

I have found a way to ignore Activate your account in my mailbox. Here is my new acc: [email protected] and the activate link: https://app.legalrobot-uat.com/email-verify?v=1Y5wiWwcvGcxznjlUsO-TuyEZgFpVbxMmQdfpEKrVTp

I never click on that link and i can still log in at app.legalrobot-uat.com

Here are steps to do: 1 - Register new account, you will get email to verify your email address 2 - Go to https://app.legalrobot-uat.com/sign-in, using Forgot password function 3 - Check your mailbox and you will get the link https://app.legalrobot-uat.com/password-reset/token?v=cFJ4kQuAfBFLqVmtyxuxxbNeudzpm4hZHwTDPcUNZd0 4 - After you changed new password. You can able to login your account without verified your email first

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original