Mapbox · Report #53531
Logging a user into attacker's account using password reset link
Validstatus
$600bounty
24upvotes
20 Oct 2017disclosed
Summary
On March 26th, 2015 @shahmeer-amir reported an issue with the password reset flow for www.mapbox.com that required social engineering to exploit. We patched the issue and awarded a bounty on April 7th, 2015.
Please note that this was not related to denial of service or the institution of an account recovery policy, both of which are out of scope for the Mapbox HackerOne program.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.