Loading HuntDB...

Vine - overwrite account associated with email via android application

Medium
X
X (Formerly Twitter)
Submitted None

Team Summary

Official summary from X (Formerly Twitter)

A logic issue in the Vine signup flow allowed a user to create a new account that would be associated with a user’s email, which could result in the user being unable to access their original account.

Reported by mishre

Vulnerability Details

Technical details and impact analysis

Improper Authentication - Generic
Hi, It's possible to deny any user from logging in to his account by overwriting the password associated with his email. This is not an account takeover because while we do override the password associated with that specific mail we just login to a "new" account and not the user's original one. Steps to reproduce: === 1) Create first account via Vine for android with the mail [email protected] with the password Bla123 2) You can now see that you can login to the account created above. 3) Go and create another account - this time with a different password and with the mail [email protected] - notice the CAPS (you can put the caps everywhere on the mail). 4) Finish the creation process - and see that it succeeds 5) Now go back and try to login with [email protected] and the password Bla123 and see that you can't. However, it's possible to login with [email protected] and the second password you have created - but you"ll login to the second created account.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$280.00

Submitted

Weakness

Improper Authentication - Generic