# VULNERABILITY REPORT: Account Takeover (ATO) ## EXECUTIVE SUMMARY A logic flaw in the password reset mechanism allowed an attacker to reset any user's password without access to their email or phone number. ## TECHNICAL DETAILS **Vulnerability:** Rate Limit Bypass + Weak OTP The password reset flow required a 6-digit OTP sent to the user's mobile. However, the endpoint to verify the OTP did not have rate limiting enabled, and the OTP did not expire after multiple failed attempts. ### Exploitation 1. Initiate password reset for `victim@example.com`. 2. Use Burp Suite Intruder to brute-force the 6-digit code (000000-999999). 3. Due to the lack of rate limiting, the correct code is found within minutes. 4. Use the valid code to set a new password and takeover the account. ## REMEDIATION - Implement strict rate limiting (e.g., 5 attempts per 10 minutes). - Invalidate the OTP after 3 failed attempts. - Increase OTP entropy or switch to magic links. ## TIMELINE - **2024-09-15**: Discovered during bug bash. - **2024-09-15**: Reported immediately. - **2024-09-16**: Fixed globally.