Liberapay · Report #361106
Unsecure changing password
N/Astatus
3upvotes
2 Jun 2018disclosed
Summary
Liberapay requires verification before you can set a new password, therefore this is not a valid issue.
How it was found
I would like to report about changing the password. When you change the password it didn't require the current password. The scenario here is when you forgot to logout your account when you login on other device it is easy to takeover the account by changing the password of it.
Impact
Easy to takeover any account