Two email addresses can access the same account
W
WakaTime
Submitted None
Actions:
Reported by
streaak
Vulnerability Details
Technical details and impact analysis
Hello Team,
When I was testing your web application I found that we can change the email address to a new email address. I tested that feature and noticed that after changing the email to a new email and then back to the old email, I can still access the account using both the email addresses.
Doing so doesn't allow the email holder of the second email address to create an account on Wakatime using the same email address, as the error shows that the email address has already been taken. I presume that this can be done for a number of emails as I haven't tested that yet.
One account clearly shouldn't be accessible by 2 email address and is a violation of secure design principles.
Let me know if you need anything else.
Best Regards,
Streaak2
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Violation of Secure Design Principles