HexBrain

HackerOne · Report #38343

Issue with password change

Validstatus
$500bounty
5upvotes
28 May 2015disclosed

How it was found

When a password is changed in user's profile, then a notification about password change is sent to the user (email). This is good.

However, user not always gets a notification about password change - when a password is changed via password reset link, then such a notification is not send to the user.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original