Legal Robot · Report #66845
- Guessing registered users in legalrobot.com
Validstatus
7upvotes
16 Sept 2016disclosed
Summary
Security researcher described a method to enumerate emails from the password reset page using brute force techniques. The response messages allowed a user to determine if an account existed. Furthermore, no rate limiting was applied.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.