# 2FA Bypass via Logical Rate Limiting Bypass

Unlock Account endpoint lacked rate limiting, letting an attacker reset the 10-attempt 2FA lockout repeatedly and brute-force the 2FA code to bypass it.

- Payout: $500
- Severity: high
- Program: -
- Credited: Jeppe Bonde Weikop
- Disclosed: 2020-01-30
- Write-up quality: 6/10
- Original: https://web.archive.org/web/20200506144651/https://medium.com/@jeppe.b.weikop/2fa-bypass-via-logical-rate-limiting-bypass-25ae2a4e1835
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200506144651-https-medium-com-jeppe-b-weikop-2fa-bypass-via-logical-rate-limiting-bypass-25ae2a4e1
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:email technique:chained vuln:auth-bypass vuln:business-logic vuln:mfa-bypass

**Target:** Web login and 2FA verification flow with account unlock feature
**Root cause:** The account unlock endpoint had no rate limiting, so the 10-failed-attempt lockout on 2FA could be reset indefinitely, and unlock links were issued even for non-locked accounts and stayed valid.
**Steps:**
1. Request an Unlock Account email for the victim account via the unlock endpoint.
2. Submit valid victim credentials to reach the 2FA prompt (login not rate limited when credentials valid).
3. Guess the 2FA code up to 10 times until lockout triggers.
4. Fetch the unlock link from the attacker's inbox via Gmail API and GET it to unlock the account.
5. Repeat the guess/unlock cycle until the correct code is found.
**How found:** After hitting the 10-attempt 2FA lockout, the author clicked the 'Unlock Account' link and hypothesized the unlock flow itself might be unthrottled; testing confirmed no rate limit, and further probing found unlock links issued for non-locked accounts and remaining valid.
**Exploitation:** Attacker with valid victim credentials requests unlock emails, brute-forces 2FA in batches of 10, and uses the emailed unlock link to reset the lockout each round, eventually guessing the code and completing login.
**Insight:** When a lockout blocks brute force, pivot to the recovery/unlock flow that resets it: check whether unlock requests are rate limited and whether unlock tokens are issued for accounts that were never locked, since that turns a hard lockout into an unlimited retry budget.