1768149 - OAuth Misconfiguration Leads to Pre Account Takeover

Status: UNCONFIRMED

(Pocket :: getpocket.com, defect)

Description

[Roneil]

Attachment: GETPOCKET POC.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Steps to reproduce:

Steps:

1. open mozilla
2. go to https://getpocket.com/
3. sign up using mail id
4. after signing up or creating an account log out
5. then sign in using gmail same as the mail that you same as the mail id used to sign up for the account.
   It automatically logs in the account it doesn't said that your account is already registered in our server.
   If you try it in other website you will not be allowed to log in because an account has already been registered with that email id.

Actual results:

Description: OAuth-based vulnerability is when the configuration of the OAuth service itself enables attackers to steal authorization associated with other users' accounts. There's a limitation that requires a validated email before going through the oauth flow, however this is bypassable. Bypassing this behaviour can frequently lead to account takeover. Either don't let the user enter with aouth when there's already another account created with the same email or let the user enter. so the impact is it does not authenticate the real user attackers can easily take over the account.