HexBrain

Uber · Report #317388

Delay of arrears notification allows Riders to take multiple rides without paying

Validstatus
11upvotes
13 Nov 2018disclosed

Summary

Due to a delay in how Uber prompts accounts that have gone into arrears (having an outstanding balance), it was possible to take rides without paying and without the account being blocked from booking new rides. This delay was a short-term issue, not a security vulnerability, and @djangohack’s account eventually prompted for payment as expected. Since we did not make any code fixes for this and it was a temporary issue, we did not decide to award it with a bounty.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original