Tucows (VDP) · Report #3523703

Password Strength Policy Bypass via Server-Side Validation Flaw

Validstatus

lowseverity

52upvotes

27 Mar 2026disclosed

Summary

It was found that the password strength policy was only enforced in the browser but not on the server side.

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original