HackerOne · Report #547

CSRF login

Validstatus

24upvotes

13 Jan 2014disclosed

How it was found

Attacker creates a fake account and changes e-mail
The e-mail confirmation link can now be used to CSRF login someone into the fake account, then monitor actions performed by the victim or even interact with him.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original