3 ms·
Title seems quite linkbaity. In a 4digit PIN-based system, being able to log in with a 4 digit PIN isn't a vuln, it's how the system works. They even state up-
by akerl_ 11y ago
Title seems quite linkbaity. In a 4digit PIN-based system, being able to log in with a 4 digit PIN isn't a vuln, it's how the system works.
They even state up-front that improvements to the system are in the works.
- nhf 11y agoAgreed. However, United still has very glaring security issues with their site that go far beyond the 4 digit PIN. I can't provide concrete details because I still have a pending bug bounty report, but stuff along the lines of bad/missing HTTPS and easy hijacking of account management sessions.