REGISTRATION USING FAKE EMAIL ACCOUNT

How it was found

1. Go to page https://liberapay.com/sign-up
2. Input email address (I tried to register with some email address)
   • [email protected]
   • [email protected]
   • [email protected]
   • [email protected]
   • [email protected]
3. Select the currency you want to use
4. click "GO" button
5. Will automatically enter into account without going through the process of verification email address first

NOTE:

• Email addresses can be verified before or after a user enters the system

Impact

Allows an attacker to flood the database with a fake account that is registered with an invalid email