地图 / “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expired

“email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expired

身份认证 / 认证缺陷（通用） / #665722

厂商: Superhuman (formerly Grammarly)
严重程度: 低危
赏金: $2,500
弱点: 认证缺陷（通用）
研究员: @l1nkworld
披露日期: 2019-08-12
资产: auth.grammarly.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（1038 字符中的一小部分）

**Summary:** It is possible bypass MFA without the need to have the phone code.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Superhuman (formerly Grammarly) 所有。

时间线

2019-08-02报告提交
2019-08-12公开披露

阅读 HackerOne 原文 ↗作者 @l1nkworld · 版权归作者与 Superhuman (formerly Grammarly) 所有

同类报告

Improper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · 2021-09-03 Bypassing Digits origin validation which leads to account takeoverX / xAI · 2020-06-24 Flickr Account Takeover using AWS Cognito APIFlickr · 2021-12-18 Chained Bugs to Leak Victim's Uber's FB Oauth TokenUber · 2019-01-25 [cs.money] Open Redirect Leads to Account TakeoverCS Money · 2020-09-30 OTP token bypass in accessing user settingsRazer · — · $1,000