4 ms·
Admin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email addr
by SifJar 6y ago
Admin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
- manigandham 6y agoThen that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.