# Verifying email bypass

Accounts created via Stripe Connect OAuth skipped email verification yet had full live-mode features, letting an attacker spoof invoices from a real company's address.

- Payout: hidden
- Severity: low
- Program: Stripe
- Found by: fisjkars
- Disclosed: 2023-03-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1121896
- Library page: https://bugbountylibrary.com/r/h1%3A1121896
- Tags: area:web3 domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:oauth technique:chained vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Stripe Dashboard / Connect OAuth account creation
**Root cause:** Accounts created through the Connect OAuth flow were not gated on email verification, unlike classic dashboard registration which restricted unverified users to test data.
**Steps:**
1. Register a normal account at `POST https://dashboard.stripe.com/ajax/register`; observe unverified email limits features to test data.
2. Start Connect OAuth: `https://connect.stripe.com/oauth/authorize?response_type=code&client_id={{CLIENT_ID}}`.
3. Choose 'create a new account', fill details, use an email you don't control (e.g. `superadmin@michelin.com`), complete SMS 2FA.
4. Account is created via API and redirected to client with access token; dashboard is fully live.
5. Create and send invoices, subscriptions, manage customers in live mode without email verification.
6. Generate invoices and validate payment/payout to attacker bank account.
**How found:** Compared behavior between classic dashboard registration and Connect OAuth registration while assessing a third-party app using Stripe; noticed classic unverified accounts were limited to test data but Connect-created accounts were not.
**Exploitation:** Attacker creates a Connect account with a victim company's email, completes SMS 2FA, then issues live invoices sent by Stripe appearing to originate from the spoofed address, and receives payouts to their own bank.
**Insight:** When a product has multiple account-creation paths (direct signup vs OAuth/Connect onboarding), compare their post-creation privilege state—verification gates applied to one path are often missing on the other.