Password Change not notified when changed from settings
身份认证 / Unverified Password Change / #242846
该报告还没有中文解读。
原文摘录
摘自原文（655 字符中的一小部分）
Password change is not notified to the account owner if its made from the account settings. This is very crucial as once the account is compromised, the attacker can change the password without giving any clue to the victim.
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Starbucks 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @karthik87mit · 版权归作者与 Starbucks 所有