Loading story…
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A researcher published a report on an account takeover issue caused by an insecure email verification flow, noting it resulted in a medium-severity bounty. No earlier event date is stated in the reference, so the publication date is used.
A separate write-up detailed an authorization bypass caused by a simple SSO implementation mistake. The reference does not specify when the issue was discovered or fixed, so the publication date is used.
A security researcher published a write-up describing a registration flaw involving weak authentication links. No underlying incident date is provided in the reference, so the publication date is used as the best estimate.
A blog post described multiple account takeover paths caused by insecure JSON Web Token handling, including tampering with invitation-related JWT fields to verify arbitrary email addresses and set victim passwords. The write-up also alleged a password reset flaw where the application failed to validate a JWT signature, allowing modification of a user ID to reset another user's password and potentially access downstream SSO-connected services.
5 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceblog.securitybreached.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026
A series of PortSwigger web security labs highlight critical vulnerabilities in authentication and authorization mechanisms, including brute-force attacks, password reset poisoning, and flawed two-factor authentication logic. Attackers can exploit weaknesses in password change and login processes to enumerate valid credentials, bypass brute-force protections by submitting multiple credentials in a single request, and manipulate password reset flows using headers like `X-Forwarded-Host` to hijack account recovery. Additionally, logic flaws in two-factor authentication allow adversaries to brute-force verification codes and gain unauthorized access to user accounts. These labs provide practical demonstrations of how improper implementation of authentication workflows can be leveraged to compromise user accounts, emphasizing the importance of robust input validation, secure session management, and comprehensive brute-force protection. The scenarios underscore the need for organizations to regularly test and update their authentication systems to defend against evolving attack techniques targeting password management and multi-factor authentication processes.
Jun 29, 2026
Cybercriminals have exploited insufficient authentication controls in widely used web-based platforms to launch large-scale spam and email bombing attacks. In one case, attackers abused the customer service platform Zendesk, which allows some customer accounts to accept support requests from anonymous users without prior verification. This configuration enabled malicious actors to generate thousands of ticket creation notifications, which were then sent from the domains of legitimate Zendesk customers such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. The emails, which could contain any subject line chosen by the attacker, included threatening messages and personal insults, and appeared to originate from the customer’s own domain, increasing their credibility and impact. The reply-to addresses in these emails were set to the legitimate support addresses of the affected organizations, further complicating mitigation efforts. Zendesk acknowledged the abuse and stated that while they recommend customers restrict ticket creation to verified users, some organizations opt for anonymous submissions for business reasons, inadvertently exposing themselves to this type of attack. Separately, a massive spam campaign was uncovered on a client’s website due to the misuse of a contact form feature that allowed users to send a copy of their message to themselves. This seemingly innocuous feature was leveraged by attackers to generate 149,700 spam emails, overwhelming the server’s resources and causing significant performance degradation. The investigation revealed that the emails were being generated locally on the server using PHP scripts, with all messages appearing to come from the legitimate website domain. The server’s email queue became saturated, and the high volume of outbound spam led to complaints from recipients and potential blacklisting of the domain. Both incidents highlight the risks associated with allowing unauthenticated or loosely authenticated email submissions in web applications and customer service platforms. Attackers can exploit these features to conduct denial-of-service attacks on inboxes, damage reputations, and disrupt business operations. The technical analysis in both cases pointed to the need for stricter authentication and verification mechanisms for user-submitted forms and support tickets. Organizations are advised to review their platform configurations, disable anonymous submissions where possible, and implement rate limiting and CAPTCHA protections to mitigate abuse. The incidents underscore the importance of balancing user convenience with security controls to prevent exploitation by malicious actors. Failure to secure these features can result in significant operational impact, reputational harm, and increased risk of further compromise. Both cases serve as a warning to organizations using third-party platforms or custom web forms to regularly audit their authentication and submission policies. Proactive monitoring and rapid response to unusual email activity are critical to minimizing the damage from such attacks. The widespread nature of these abuses suggests that many organizations may be unknowingly vulnerable to similar exploitation. Security teams should prioritize the review of all externally facing forms and ticketing systems to ensure robust protections are in place.
Jun 29, 2026