| Titolo | 6amTech 6valley 16.0 Authorization Bypass |
|---|
| Descrizione | The `existing-account-check` endpoint is part of the mobile-app social-login flow. Its `user_response=1` branch is meant to be reached only after a social provider has verified
the caller's identity, but the server performs no such verification: it looks up the user solely by the client-supplied email address and, when `user_response` equals 1, marks the email verified and immediately returns a fresh Passport access token for that account (Laravel Passport JWT). No social provider token, OTP, or password is ever validated.
public function existingAccountCheck(Request $request): JsonResponse
{
$user = $this->customerRepo->getFirstWhere(params: ['email' => $request['email']]);
if (!$user) { return response()->json(['temp_token' => $temporaryToken, 'status' => false]); }
if ($request['user_response'] == 1) {
$this->customerRepo->updateWhere(params: ['id' => $user['id']], data: [
'email_verified_at' => now(), 'login_medium' => $request['medium'],
]);
$token = $user->createToken('LaravelAuthApp')->accessToken;
return response()->json(['token' => $token, 'status' => true]);
}
...
}
The endpoint is unauthenticated. Account existence is additionally enumerable via the response difference (status=false for unknown emails) and the companion check-email /check-phone endpoints. |
|---|
| Utente | havel8964 (UID 98694) |
|---|
| Sottomissione | 12/10/2026 00:48 (26 giorni fa) |
|---|
| Moderazione | 04/11/2026 15:35 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 431085 [6amTech 6valley 16.0 Social Login Flow existing-account-check existingAccountCheck user_response escalationi di privilegi] |
|---|
| Punti | 20 |
|---|