# Blind account takeover

Signup activation link accepted semicolon-separated multiple emails, so attacker could pre-seed a victim's signup and later claim the account via their own activation link.

- Payout: $250
- Severity: low
- Program: -
- Credited: Bartłomiej Bergier
- Disclosed: 2022-09-25
- Write-up quality: 6/10
- Original: https://bergee.it/blog/blind-account-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Abergee-it-blog-blind-account-takeover
- Tags: domain:web impact:ato kind:bounty platform:blog sev:low tech:rest technique:param-pollution vuln:account-takeover vuln:business-logic

**Target:** Signup/activation endpoint with base64 user parameter
**Root cause:** Server-side email handling split the user-supplied email on semicolons and sent the same activation link to all addresses, binding them to one account without verifying a single owner.
**Steps:**
1. Craft payload `victim@mail.com;<spaces>attacker@mail.com`
2. Base64-encode it and place in `https://target.com/signup/?user=<b64>`
3. Send link to victim; victim submits form, activation link delivered to both mailboxes
4. Wait for victim to populate account, then open attacker's activation link to access the same account
**How found:** While testing the activation link, researcher hypothesized entering two emails separated by a semicolon; both mailboxes received identical messages and both links led to the same account, revealing multi-email binding. Spaces before the second email hid it from the victim's form display.
**Exploitation:** Attacker delivers crafted signup URL to victim; victim completes signup, generating an activation link sent to both victim and attacker. Attacker waits up to the 3-hour link validity for victim to enter data, then uses their activation link to land in the victim's account.
**Insight:** When a signup/activation flow takes an email in a URL parameter, try delimiter injection (semicolon, comma, spaces) to bind multiple addresses to one account; check whether the server splits and mails all of them while the UI shows only one.