8x8 · Report #893085
2FA Disable With Wrong Password - Response Tampering.
Validstatus
highseverity
14upvotes
21 Oct 2020disclosed
Summary
The application contained a business logic flaw that resulted in missing validation when removing 2FA on the authenticated account.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.