Courier · Report #947349
Bypass Too Many Requests Sign Up
Informativestatus
mediumseverity
6upvotes
30 Jul 2020disclosed
Summary
Courier makes a rate limit check before allowing a user to register; this rate limit check can be bypassed and a user account can be created by sending a request directly to the AWS Cognito API – which is not rate limited.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.