Valve · Report #410221
unlock self-lock by brute force
Validstatus
mediumseverity
$900bounty
27upvotes
23 Jan 2019disclosed
Summary
Due to a missing protection on the self account unlock feature, self unlock codes could be bruteforced - leading to unrestricted access to the account. The endpoint issue has been corrected.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.