Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties
身份认证 / Authentication Bypass Using an Alternate Path or Channel / #922456
该报告还没有中文解读。
原文摘录
摘自原文（2398 字符中的一小部分）
Summary There's a limitation that requires a validated email before going through the OAuth flow, however this is bypassable. Bypassing this means the target site assumes your email is validated, and actually ends up signing you in with an non-validated email. This behavior can frequently lead to …
原文中的代码
POST /oauth/authorize HTTP/1.1 Host: gitlab.com Content-Type: application/x-www-form-urlencoded Content-Length: 354 DNT: 1 Connection: close Cookie: [COOKIES] utf8=%E2%9C%93&authenticity_token=[CSRF …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 GitLab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cache-money · 版权归作者与 GitLab 所有