Vimeo: Full account takeover via Add a New Email to account without email verified and without password confirmation.

2015-01-25T01:05:36
ID H1:45084
Type hackerone
Reporter a7medel-ma7alawy
Modified 2015-03-06T07:26:26

Description

Description :

This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals

Bug :

Add a New Email to account without email verified and without password confirmation when the leaves open email ,Leading to the theft of account In less than a minute by reset password .

PoC:

http://goo.gl/tsqR60

Suggestion for fix a bug :

Request Confirm password to add this email.

Example :

http://goo.gl/y3mK0C

Regards, Ahmed El-Mahalawy