Uber · Report #317388
Delay of arrears notification allows Riders to take multiple rides without paying
Validstatus
11upvotes
13 Nov 2018disclosed
Summary
Due to a delay in how Uber prompts accounts that have gone into arrears (having an outstanding balance), it was possible to take rides without paying and without the account being blocked from booking new rides. This delay was a short-term issue, not a security vulnerability, and @djangohack’s account eventually prompted for payment as expected. Since we did not make any code fixes for this and it was a temporary issue, we did not decide to award it with a bounty.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.