POJIA破甲
地图 / 2fa can't be activated on app.pullrequest.com

2fa can't be activated on app.pullrequest.com

身份认证 / 违反安全设计原则(按标题归类) / #2463069

厂商
HackerOne
严重程度
低危 · CVSS 0
赏金
—
弱点
违反安全设计原则(按标题归类)
研究员
@iam_srpk
披露日期
2024-07-11
资产
app.pullrequest.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(531 字符中的一小部分)
**Summary:** Hello Team, Since you are using deprecated google chart API service (which doesn't work now) for generating 2fa qr code image, users cannot setup 2fa for securing account.

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 HackerOne 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @iam_srpk · 版权归作者与 HackerOne 所有

同类报告

Account Takeover at worki.ruMail.ru · — · $1,500Leak of authorization urls leads to account takeoverBumble · 2020-05-08Password not checked when disabling 2FA on HackerOneHackerOne · 2019-06-07Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeWakaTime · 2025-08-05ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNTMattermost · 2022-01-05Login page password-guessing attackRevive Adserver · 2024-04-19