IRCCloud · Report #6884
Leaking Referrer in Reset Password Link
Validstatus
$100bounty
5upvotes
12 Apr 2014disclosed
Summary
Clicking on external links within the reset password page leaked password reset token in the referer header.
How it was found
I have found that you are leaking via the referrer the reset password link. I am attaching the photo as proof of concept that the site is indeed leaking the reset password link via the referrer.
Thats when someone loads the reset password link and decided to click on external links.
Its the time the referrer is leak ( see attached photo )
Clifford Trigo