身份认证

登录、注册、找回密码、多因素认证和 SSO。任何一个环节出错都可能变成账户接管。

影响

绕过认证或接管任意用户账户

观察点

在不知道密码或第二因素的情况下登录了目标账户

修复

统一认证逻辑，对重置令牌设置短有效期并一次性使用，严格校验 JWT 签名与 OAuth state。

弱点分布

• 认证缺陷（通用）790
• 认证尝试次数未限制118
• Unlabeled105
• 违反安全设计原则（按标题归类）89
• 凭据保护不足43
• 会话过期不足43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• 会话固定15
• Weak Password Recovery Mechanism for Forgotten Password11
• Missing Authentication for Critical Function8
• 认证绕过6
• Unverified Password Change5
• Missing Critical Step in Authentication3
• Authentication Bypass by Spoofing2
• Brute Force2
• Use of Default Credentials2
• Authentication Bypass by Capture-replay1
• Reusing Session IDs (aka Session Replay)1
• Weak Password Requirements1

共现类别

暂无共现数据。

高票报告

当前状态 1,292 份 · 全部 1,292 · 筛选赏金 $351,439

1. 3,006
   Takeover an account that doesn't have a Shopify ID and moreShopify · 2020-09-02 · 严重
   $0Unlabeled
2. 1,642
   Account takeover via leaked session cookieHackerOne · 2019-12-04 · 高危
   $20,000凭据保护不足
3. 1,409
   Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · 2020-01-09 · 高危
   $15,300Missing Authentication for Critical Function
4. 972
   Improper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · 2021-09-03 · 严重
   $0认证缺陷（通用）
5. 783
   Subdomain Takeover to Authentication bypassRoblox · 2020-04-24 · 严重
   $0Unlabeled
6. 619
   Bypassing Digits origin validation which leads to account takeoverX / xAI · 2020-06-25 · 未评级
   $0认证缺陷（通用）
7. 440
   Flickr Account Takeover using AWS Cognito APIFlickr · 2021-12-18 · 严重
   $0认证缺陷（通用）
8. 427
   Chained Bugs to Leak Victim's Uber's FB Oauth TokenUber · 2019-01-26 · 高危
   $0认证缺陷（通用）
9. 391
   Account Takeover worki.ruMail.ru · — · 未评级
   $1,700认证尝试次数未限制
10. 375
    CVE-2019-5765: 1-click HackerOne account takeover on all Android devicesChrome · — · 未评级
    $0Unlabeled
11. 359
    Account TakeOver at my.33slona.ruMail.ru · — · 未评级
    $1,700认证尝试次数未限制
12. 357
    [cs.money] Open Redirect Leads to Account TakeoverCS Money · 2020-09-30 · 中危
    $0认证缺陷（通用）
13. 339
    OTP token bypass in accessing user settingsRazer · — · 未评级
    $1,000认证缺陷（通用）
14. 313
    Reset any passwordpixiv · 2021-03-31 · 高危
    $0Weak Password Recovery Mechanism for Forgotten Password
15. 312
    Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Uber · 2016-07-15 · 未评级
    $0认证缺陷（通用）
16. 303
    2FA bypass by sending blank codeGlassdoor · — · 未评级
    $0认证缺陷（通用）
17. 288
    Bypass Password Authentication for updating email and phone number - Security VulnerabilityX / xAI · 2020-02-08 · 高危
    $0认证缺陷（通用）
18. 277
    Insufficient OAuth callback validation which leads to Periscope account takeoverX / xAI · 2019-04-11 · 未评级
    $0认证缺陷（通用）
19. 263
    Insufficient validation on Digits bridgeX / xAI · 2020-08-20 · 未评级
    $0认证缺陷（通用）
20. 260
    Ability to DOS any organization's SSO and open up the door to account takeoversSuperhuman (formerly Grammarly) · 2021-04-16 · 高危
    $10,500认证缺陷（通用）
21. 257
    Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesGitLab · 2020-10-02 · 高危
    $3,000Authentication Bypass Using an Alternate Path or Channel
22. 253
    Mass Account Takeover at https://app.taxjar.com/ - No user InteractionStripe · 2022-07-11 · 严重
    $0Authentication Bypass Using an Alternate Path or Channel
23. 251
    Improper Validation at Partners LoginEternal · 2021-10-06 · 严重
    $2,000认证缺陷（通用）
24. 244
    Stealing SSO Login Tokens (snappublisher.snapchat.com)Snapchat · 2021-07-30 · 高危
    $7,500认证绕过
25. 219
    Incorrect authorization to the intelbot service leading to ticket informationTikTok · 2022-02-23 · 严重
    $15,000认证缺陷（通用）