PentestingHere
Log in Join
[HIGH] · HackerOne P2 · Accepted

Broken Authentication in Password Change Endpoint – current_password Verification Can Be Bypassed with null

AbdEl-Rahman Hamouda AbdEl-Rahman Hamouda www.example.com 16 Aug 2026

The affected asset is anonymised at the researcher's request.

Summary:

The password change endpoint POST /api/pwa/updatePassword is designed to require the user's current password before allowing a password change. However, the server fails to properly validate the current_password field: sending null instead of the actual current password is accepted, and the server responds with 200 OK while successfully changing the account password.

Steps To Reproduce:

  1. Log in with a test account on www.example.com and capture a valid authenticated session (cookies + XSRF-TOKEN).
  2. Send a normal password change request to confirm expected behavior:
POST /api/pwa/updatePassword HTTP/1.1
   Host: www.example.com
   Content-Type: text/plain;charset=UTF-8
   Cookie: [REDACTED - valid session cookies]
   XSRF-TOKEN: [REDACTED]