Bypass email verification when register new account
Unknown
Vulnerability Details
Hi Legalrobot,
I have found a way to ignore Activate your account in my mailbox.
Here is my new acc: [email protected] and the activate link:
https://app.legalrobot-uat.com/email-verify?v=1Y5wiWwcvGcxznjlUsO-TuyEZgFpVbxMmQdfpEKrVTp
I never click on that link and i can still log in at app.legalrobot-uat.com
Here are steps to do:
1 - Register new account, you will get email to verify your email address
2 - Go to https://app.legalrobot-uat.com/sign-in, using Forgot password function
3 - Check your mailbox and you will get the link https://app.legalrobot-uat.com/password-reset/token?v=cFJ4kQuAfBFLqVmtyxuxxbNeudzpm4hZHwTDPcUNZd0
4 - After you changed new password. You can able to login your account without verified your email first
Actions
View on HackerOneReport Stats
- Report ID: 265749
- State: Closed
- Substate: not-applicable
- Upvotes: 3