# I Could Have Hacked All Uber Accounts- But I Chose to Report it Instead

Uber APIs leaked any user's UUID via phone/email and returned their mobile access token, enabling full account takeover of riders, drivers and Eats users.

- Payout: $6,500
- Severity: critical
- Program: Uber
- Credited: Anand Prakash
- Disclosed: 2019-09-13
- Write-up quality: 7/10
- Original: https://hackernoon.com/how-i-could-have-hacked-all-uber-accounts-rtzl3z72
- Library page: https://bugbountylibrary.com/r/blog%3Ahackernoon-com-how-i-could-have-hacked-all-uber-accounts-rtzl3z72
- Tags: domain:api impact:ato impact:pii-leak kind:bounty platform:blog sev:critical tech:rest technique:recon vuln:access-control vuln:account-takeover vuln:idor vuln:info-disclosure

**Target:** Uber partner/marketplace RPC APIs (partners.uber.com, bonjour.uber.com)
**Root cause:** addDriverV2 leaked the target user's UUID in its 'not found' error message, and getConsentScreenDetails accepted an arbitrary userUuid without authorization, returning the victim's full profile including mobile access token.
**Steps:**
1. Enumerate victim UUID: `POST /p3/fleet-manager/_rpc?rpc=addDriverV2` to partners.uber.com with `{"nationalPhoneNumber":"99999xxxxx","countryCode":"1"}` or `{"email":"xxx@gmail.com"}`; error message leaks UUID.
2. Send `POST /marketplace/_rpc?rpc=getConsentScreenDetails` to bonjour.uber.com with body `{"language":"en","userUuid":"<victim UUID>"}`.
3. Response returns victim's profile including `token` (mobile access token), email, phone, location.
4. Use leaked token to authenticate as victim and access rides, payment info, request rides.
**How found:** Researcher noticed addDriverV2 error responses echoed the looked-up user's UUID, then tested whether getConsentScreenDetails would accept an arbitrary userUuid and return sensitive fields like the access token.
**Exploitation:** Attacker obtains victim UUID via unauthenticated error-message leak, then calls getConsentScreenDetails with that UUID to receive the victim's mobile access token and PII, using the token to fully hijack the account (view/request rides, payment info, track location).
**Escalation:** Same primitive applied to riders, partners, drivers and Eats accounts, enabling mass account takeover.
**Insight:** Error messages on lookup/RPC endpoints can leak internal identifiers (UUIDs); once you have a stable user identifier, test every RPC that takes it as a parameter for missing object-level authorization and sensitive fields like tokens in the response.