Security misconfiguration

Disclosed: 2022-05-16 09:41:20 By mr23r0 To lemlist
High
Vulnerability Details
## Description : When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link. Steps to reproduce : 1. go to app.lemilist.com 2. create a magic link 3. use it to login 4. now open another browser or incognito window 5. use that same magic link And You'll be logged in in your account. ## Impact If Attacker gets the magic link of user he can login into victim's account. Account takeover. Mitigation : 1. Add a limit to magic link and remove the magic link from database after 1 use. 2. only allow the Requester IP to login using the magic link.
Actions
View on HackerOne
Report Stats
  • Report ID: 1486327
  • State: Closed
  • Substate: resolved
  • Upvotes: 14
Share this report