| 标题 | 6amTech 6valley 16.0 Authorization Bypass |
|---|
| 描述 | The `existing-account-check` endpoint is part of the mobile-app social-login flow. Its `user_response=1` branch is meant to be reached only after a social provider has verified
the caller's identity, but the server performs no such verification: it looks up the user solely by the client-supplied email address and, when `user_response` equals 1, marks the email verified and immediately returns a fresh Passport access token for that account (Laravel Passport JWT). No social provider token, OTP, or password is ever validated.
public function existingAccountCheck(Request $request): JsonResponse
{
$user = $this->customerRepo->getFirstWhere(params: ['email' => $request['email']]);
if (!$user) { return response()->json(['temp_token' => $temporaryToken, 'status' => false]); }
if ($request['user_response'] == 1) {
$this->customerRepo->updateWhere(params: ['id' => $user['id']], data: [
'email_verified_at' => now(), 'login_medium' => $request['medium'],
]);
$token = $user->createToken('LaravelAuthApp')->accessToken;
return response()->json(['token' => $token, 'status' => true]);
}
...
}
The endpoint is unauthenticated. Account existence is additionally enumerable via the response difference (status=false for unknown emails) and the companion check-email /check-phone endpoints. |
|---|
| 用户 | havel8964 (UID 98694) |
|---|
| 提交 | 2026-10-12 00時48分 (26 日前) |
|---|
| 管理 | 2026-11-04 15時35分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431085 [6amTech 6valley 16.0 Social Login Flow existing-account-check existingAccountCheck user_response 权限提升] |
|---|
| 积分 | 20 |
|---|