Vimeo.com Insecure Direct Object References Reset Password

How it was found

Hello, my name is Toufik Airane. This is Responsible Disclosure and Silent Disclosure.

Thanks you to opened bug bounty program!

Please find a proof of concept for IDOR attack on famous vimeo.com. With this IDOR, attacker can reset any password, of any account and take controle of it.

Please, find in attachment a PDF and a MP4 who explains tricks.

Cheers,