地图 / User can request for password reset link without giving his website, eventhough he have it

User can request for password reset link without giving his website, eventhough he have it

身份认证 / 违反安全设计原则（按标题归类） / #25270

厂商: Cloudflare Vulnerability Disclosure
严重程度: 未评级
赏金: —
弱点: 违反安全设计原则（按标题归类）
研究员: —
披露日期: —
资产: —
CVE: —

该报告还没有中文解读。

时间线

暂无时间线。

阅读 HackerOne 原文 ↗作者见原文 · 版权归作者与 Cloudflare Vulnerability Disclosure 所有

同类报告

Account Takeover at worki.ruMail.ru · — · $1,500 Leak of authorization urls leads to account takeoverBumble · 2020-05-08 Password not checked when disabling 2FA on HackerOneHackerOne · 2019-06-07 Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorizeWakaTime · 2025-08-05 ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNTMattermost · 2022-01-05 Login page password-guessing attackRevive Adserver · 2024-04-19

User can request for password reset link without giving his website, eventhough he have it · 破甲 POJIA