地图 / Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

身份认证 / Missing Authentication for Critical Function / #739737

厂商: PayPal
严重程度: 中危 · CVSS 8
赏金: $15,300
弱点: Missing Authentication for Critical Function
研究员: @alexbirsan
披露日期: 2020-01-08
资产: *.paypal.com
CVE: —

该报告还没有中文解读。

时间线

2019-11-18报告提交
2020-01-08公开披露

阅读 HackerOne 原文 ↗作者 @alexbirsan · 版权归作者与 PayPal 所有

同类报告

[c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMail.ru · —Authentication bypass for ███ leads to take over any users account.Krisp · 2022-10-31 Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadataShopify · 2026-11-03 · $3,100 Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open RedirectAWS VDP · 2026-10-16 Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · 2026-10-14 Administration page visible without authenticationVisma Public · — · $100