Mail.ru: [pandao.ru] possibility to attach arbitrary phone number to account registered via social network

2019-11-02T19:21:41
ID H1:727974
Type hackerone
Reporter n4sty
Modified 2020-03-06T10:37:42

Description

It was possible to attach an arbitrary unregistered phone number to account registered via different id (e.g. social network id). This behavior can prevent user from registering with his phone number and facilitate phishing attack if victim attempts to login by phone number.