Loading story…
A series of PortSwigger web security labs highlight critical vulnerabilities in authentication and authorization mechanisms, including brute-force attacks, password reset poisoning, and flawed two-factor authentication logic. Attackers can exploit weaknesses in password change and login processes to enumerate valid credentials, bypass brute-force protections by submitting multiple credentials in a single request, and manipulate password reset flows using headers like X-Forwarded-Host to hijack account recovery. Additionally, logic flaws in two-factor authentication allow adversaries to brute-force verification codes and gain unauthorized access to user accounts.
These labs provide practical demonstrations of how improper implementation of authentication workflows can be leveraged to compromise user accounts, emphasizing the importance of robust input validation, secure session management, and comprehensive brute-force protection. The scenarios underscore the need for organizations to regularly test and update their authentication systems to defend against evolving attack techniques targeting password management and multi-factor authentication processes.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A PortSwigger lab demonstrated that the password change function leaked enough information through its error handling to let an attacker enumerate a valid current password for another user, enabling account compromise through brute force.
A PortSwigger lab documented a password reset poisoning issue in which the application trusted the X-Forwarded-Host header when generating reset links, allowing an attacker to redirect a victim's reset token to an attacker-controlled domain and take over the account.
A PortSwigger lab showed that a login endpoint accepted multiple passwords in a single JSON request, enabling attackers to test many candidate passwords at once and bypass intended brute-force protections such as rate limiting or lockouts.
A PortSwigger lab demonstrated that flawed 2FA verification logic could be abused by manipulating the verify parameter, allowing an attacker to generate and brute-force 2FA codes for another user's account and gain unauthorized access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026
Multiple web application labs demonstrate how flawed access control mechanisms can be exploited to escalate privileges. In one scenario, method-based access control is circumvented by manipulating HTTP request methods, allowing a non-admin user to perform administrative actions. Another lab highlights the risks of relying on the `Referer` header for access control, showing that attackers can bypass restrictions by crafting requests with manipulated headers and session cookies. A third lab exposes a multi-step process vulnerability, where the absence of access control on a critical step enables unauthorized role changes by replaying requests with altered session data. These labs underscore the dangers of implementing weak or incomplete access control checks, particularly when relying on easily manipulated HTTP methods or headers. The demonstrations provide practical examples of how attackers can exploit such flaws using tools like Burp Suite to intercept and modify requests, emphasizing the need for robust, defense-in-depth access control strategies in web applications.
Jul 12, 2026
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026