# Airbnb : Steal Earning of Airbnb hosts by Adding Bank Account/Payment Method (IDOR)

IDOR on Airbnb's payoneer_account_redirect payout_ID let attackers obtain a victim host's Payoneer link and attach their own bank account to steal earnings.

- Payout: $3,000
- Severity: high
- Program: Airbnb
- Credited: Vijay Kumar
- Disclosed: 2019-12-24
- Write-up quality: 6/10
- Original: https://www.indoappsec.in/2019/12/airbnb-steal-earning-of-airbnb-hosts-by.html
- Library page: https://bugbountylibrary.com/r/blog%3Aindoappsec-in-2019-12-airbnb-steal-earning-of-airbnb-hosts-by-html
- Tags: domain:web impact:funds-loss kind:bounty platform:blog sev:high tech:payment technique:source-review vuln:access-control vuln:business-logic vuln:idor

**Target:** Payout preferences / Payoneer account redirect endpoint
**Root cause:** The payoneer_account_redirect endpoint keyed off a sequential/guessable payout_ID without verifying the requesting user owned that payout record, so any authenticated user could fetch another host's Payoneer registration link.
**Steps:**
1. Create victim account, start adding payout details, add bank address, capture `POST /users/payoneer_account_redirect/[payout_ID]` and note payout_ID; do not finish bank details.
2. Create attacker account, start payout flow, capture same request.
3. Replace payout_ID with victim's payout_ID and send `POST /users/payoneer_account_redirect/[victim_payout_ID]` with `authenticity_token=&user_id=[user_id]`.
4. Server returns victim's Payoneer link; fill attacker bank details and save, attaching them to victim's account.
**How found:** Researcher observed that adding payout info generates a payout_ID used to fetch a Payoneer link containing a registration token, and hypothesized the ID was not authorization-checked, then swapped IDs between two accounts.
**Exploitation:** Attacker registers, initiates payout flow to obtain a valid session, then swaps the payout_ID in the redirect request for a victim's unused payout_ID. The returned Payoneer link is bound to the victim's Airbnb account, so completing bank details redirects the victim's future earnings to the attacker's bank account.
**Insight:** Payout/onboarding flows that mint a tokenized third-party link keyed by an internal ID are prime IDOR targets: test the redirect/link-generation request with another account's ID before the account is fully onboarded, since unused IDs are still accepted.