~ / research / idor-race-ato

Chaining IDOR and a race condition for account takeover

A timing window in a password-reset flow turned a low-severity IDOR into full ATO.

An IDOR on its own was rated low. Combined with a race condition in the reset flow, it became a full account takeover.

The chain

Walk through the two bugs and why their combination changed severity dramatically.

raceidorato