| 제목 | 6amTech 6valley 16.0 Authorization Bypass |
|---|
| 설명 | The `existing-account-check` endpoint is part of the mobile-app social-login flow. Its `user_response=1` branch is meant to be reached only after a social provider has verified
the caller's identity, but the server performs no such verification: it looks up the user solely by the client-supplied email address and, when `user_response` equals 1, marks the email verified and immediately returns a fresh Passport access token for that account (Laravel Passport JWT). No social provider token, OTP, or password is ever validated.
public function existingAccountCheck(Request $request): JsonResponse
{
$user = $this->customerRepo->getFirstWhere(params: ['email' => $request['email']]);
if (!$user) { return response()->json(['temp_token' => $temporaryToken, 'status' => false]); }
if ($request['user_response'] == 1) {
$this->customerRepo->updateWhere(params: ['id' => $user['id']], data: [
'email_verified_at' => now(), 'login_medium' => $request['medium'],
]);
$token = $user->createToken('LaravelAuthApp')->accessToken;
return response()->json(['token' => $token, 'status' => true]);
}
...
}
The endpoint is unauthenticated. Account existence is additionally enumerable via the response difference (status=false for unknown emails) and the companion check-email /check-phone endpoints. |
|---|
| 사용자 | havel8964 (UID 98694) |
|---|
| 제출 | 2026. 10. 12. AM 12:48 (26 날 ago) |
|---|
| 모더레이션 | 2026. 11. 04. PM 03:35 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 431085 [6amTech 6valley 16.0 Social Login Flow existing-account-check existingAccountCheck user_response 권한 상승] |
|---|
| 포인트들 | 20 |
|---|