WRITEUP #3482

[$5K] Misconfigured Reset password that leads to Account Takeover (No user Interaction ATO)

Auth BypassAccount takeoverPassword resetInformation disclosure

by@Assass1nmarcos(Aditya Sharma)

Bounty

5,000

Program

Published

Aug 24, 2021

Added to HackDex

Sep 15, 2022

Read Full Writeuphttps://medium.com/@noob.assassin/5k-misconfigured-reset-password-that-leads-to-account-takeover-no-user-interaction-ato-e6a36b8ef183

▸ RELATED WRITEUPS

Breaking the Barrier: Admin Panel Takeover Worth $3500

Auth BypassAuthentication bypass

Interesting Story of an Account Takeover Vulnerability

Auth BypassAccount takeover

Instagram and Meta 2FA Bypass by Unprotected Backup Code Retrieval in Accounts Center

Auth Bypass2FA / MFA bypass

How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System

ReconMissing authentication

Forced SSO Session Fixation

Auth BypassSSO

Built with ❤️ by Shubham Rawat