CSRF in Account Deletion feature (https://www.flickr.com/account/delete)

Summary

CSRF was missing in Account Deletion form due to switching login providers. @asad0x01_ found the vulnerability and reported it concisely, even with a video POC.

The issue was fixed with 60 days, but we were slow to resolve the ticket and disclose.

Sometimes you just get lucky. When Flickr was owned by Yahoo, they used to use Yahoo Authentication system (https://login.yahoo.com) . When Flickr got sold to SmugMug, they introduced new login flow (https://identity.flickr.com). Basically in their previous login flow, they used to use the Yahoo authentication code as CSRF token while deleting account. While testing the account deletion feature, I noticed that there were no CSRF token :/ Later found out it was because of the new login flow.