Khan Academy · Report #266090
Possible to join any class without coache's knowledge & Little Information Disclosure
Validstatus
mediumseverity
6upvotes
12 Oct 2017disclosed
Summary
Students could join a class using only a 6-character class code. We have increased the codes to 8 characters to make them a bit harder to guess and provide a better balance between security and usability.
/
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.