Account Take Over by Response Manipulation

Technical information

signup page
login page
Login request and response of abc@mail.com
login again
Login request of Account 1 (abc@gmail.com)
401 Unauthorized
200 OK signup response of Account 2 (xyz@gmail.com)
Account 1 (abc@gmail.com) settings page

Security Researcher | Security Engineer | Gamer | Security Nerd…

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store