地图 / total Failure of password protection while extracting seed phrase! increases attack surface area for scammers

total Failure of password protection while extracting seed phrase! increases attack surface area for scammers

身份认证 / Authentication Bypass Using an Alternate Path or Channel / #2280279

厂商: MetaMask
严重程度: 低危 · CVSS 6.1
赏金: $3,500
弱点: Authentication Bypass Using an Alternate Path or Channel
研究员: @bug_vs_me
披露日期: 2025-07-31
资产: MetaMask Browser Extension
CVE: —

该报告还没有中文解读。

时间线

2023-12-10报告提交
2025-07-31公开披露

阅读 HackerOne 原文 ↗作者 @bug_vs_me · 版权归作者与 MetaMask 所有

同类报告

Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesGitLab · 2020-10-01 · $3,000 Mass Account Takeover at https://app.taxjar.com/ - No user InteractionStripe · 2022-07-11 Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/Stripe · 2022-10-19 Account Takeover via Authentication Bypass in TikTok Account RecoveryTikTok · 2024-07-13 · $12,000 Authentication Bypass Leads To Complete Account TakeveOver on ██████████MTN Group · 2024-09-14 Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)MTN Group · 2025-03-04