Valve · Report #407971
[help.steampowered.com] Account takeover bruteforcing SteamGuard
Validstatus
highseverity
$2,500bounty
112upvotes
23 Jan 2019disclosed
Summary
Due to a missing protection on a support endpoint, email verification codes could be bruteforced - leading to possible account takeover. The endpoint issue has been corrected.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.