﷽

﴿ اَلصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِ اللهِ صَلَّى اللهُ عَلَيْهِ وَسَلَّمَ ﴾

✦••┈┈┈┈┈┈┈••✦

One day I woke up, I had a day off from my job as a penetration tester at GM. I decided to spend my free time hunting on a new program, let's call it ammar.com. Sounds good? Great.

I started by creating a new account with an email. The system asked me for a verification code that gets sent to the email.

• I tried entering random codes → didn't work.

• I tried some response manipulation → didn't work.

• I even tried sending null values → still nothing.

• Then I thought of bypassing directly to the next step… Boom 💥→ didn't work either.

But I didn't stop there. I looked deeper and tried to access an internal endpoint for account details. I found one at:

ammar.com/profile

And guess what? This worked! I managed to bypass the verification step completely.

At this point, I had an account registered with the victim's email:

victim@gmail.com

but it wasn't fully activated yet.

Now the big question: should I stop here and submit it as code verification bypass?

No, that's not enough. I had to push it further.

So, I tried registering a new account again but this time using Google OAuth with the same email:

victim@gmail.com

💥 Boom! The system automatically verified the account (since it trusted Google OAuth) and merged it with the account I had already created earlier.

Result? I now had full access to the victim's account.

This is a classic OAuth Verification Bypass → Account Takeover.

⸻

Scenario (Attack Flow)

1. Attacker signs up with victim@gmail.com via normal registration.

2. Email verification is required, but the attacker bypasses it through /profile.

3. Victim later signs up with the same email using Google OAuth.

4. System trusts Google and marks the account as verified.

5. Attacker's account is now the victim's verified account → Account Takeover.

⸻

Impact

• Full Account Takeover (Critical : medium– P1 : P3).

• Attacker can access, modify, or delete victim's account data.

• Puts user privacy and system security at serious risk.

• Potential abuse if accounts are linked to other services.

🔥 That's it – from a simple verification code bypass to a one-click Account Takeover.

Doom(Ammar yasser )