# Information disclosure -> 2fa bypass -> POST exploitation

Algolia's 2FA renew endpoint returned the gauth_secret in the response, letting a session-hijacker generate valid TOTP codes and bypass 2FA on critical actions.

- Payout: hidden
- Severity: medium
- Program: Algolia
- Found by: akashhamal0x01
- Disclosed: 2021-09-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1276373
- Library page: https://bugbountylibrary.com/r/h1%3A1276373
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:account-takeover vuln:info-disclosure vuln:mfa-bypass

**Target:** Account support 2FA renew endpoint (www.algolia.com/account/support)
**Root cause:** The 2FA 'Renew' API response includes the user's TOTP shared secret (gauth_secret) in cleartext, exposing the second factor to anyone with session access.
**Steps:**
1. Log in to algolia.com and go to `https://www.algolia.com/account/support`
2. Click 'Renew' on the 2FA section and intercept the request in Burp
3. Send the request to Repeater and replay it
4. Inspect the response for `gauth_secret` and copy its value
5. Add the secret to Google Authenticator to generate valid TOTP codes
6. Use the codes to pass 2FA checks on email change, account deletion, etc.
**How found:** Noted that critical actions were gated by old-password or 2FA checks, then hunted for a way to obtain the second factor; inspected the 2FA renew response and spotted the unnecessary gauth_secret field.
**Exploitation:** Attacker with an authenticated session (e.g. shared/cyber-cafe machine left logged in) replays the 2FA renew request, extracts gauth_secret, imports it into an authenticator app, and supplies valid TOTP codes to satisfy 2FA gates on email change, recovery-code download, and account deletion.
**Escalation:** Chains the info leak into full 2FA bypass, enabling account takeover via email change and account deletion.
**Insight:** When 2FA gates critical actions, audit every 2FA-related endpoint response (enroll/renew/status) for the TOTP shared secret or backup codes — the second factor is only as strong as its confidentiality in API responses.