# Social Club Account Takeover Via RGL And Steam/Epic Linked Account

Rockstar Launcher trusted a linked Steam/Epic account as proof of identity, letting an attacker switch into the victim's Social Club account without credentials, bypassing MFA.

- Payout: hidden
- Severity: high
- Program: Rockstar Games
- Found by: hacktus
- Disclosed: 2021-11-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1235008
- Library page: https://bugbountylibrary.com/r/h1%3A1235008
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Rockstar Games Launcher / Social Club account linking
**Root cause:** The Launcher assumed that access to a linked third-party (Steam/Epic) account implied the authentic Social Club user, so account switching did not require Social Club credentials.
**Steps:**
1. Obtain access to a Steam or Epic Games account entitled to GTAV/RDR2 that was previously linked to the victim's Social Club account.
2. Launch an R* game via the Rockstar Games Launcher.
3. Use the Launcher's account switch flow to select the victim's Social Club account.
4. Launcher grants access without prompting for Social Club credentials, even with MFA enabled.
**Exploitation:** Attacker with control of a previously-linked Steam/Epic account launches an R* game and switches to the victim's Social Club account; the Launcher treats third-party account access as authentication and grants full account access without credentials or MFA.
**Insight:** Account-linking flows that treat possession of a linked third-party account as sufficient authentication are a takeover vector: test whether switching into a linked identity re-prompts for the primary account's credentials, especially when MFA is enabled.