# Flickr Account Takeover using AWS Cognito API

Flickr's Cognito login accepted unverified, case-variant emails, letting an attacker set their email to the victim's address and log in as them.

- Payout: hidden
- Severity: critical
- Program: Flickr
- Found by: lauritz
- Disclosed: 2021-12-18
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1342088
- Library page: https://bugbountylibrary.com/r/h1%3A1342088
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:aws tech:oauth technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Amazon Cognito User Pool API / identity.flickr.com login
**Root cause:** Flickr trusts Cognito email attributes without checking email_verified, and normalizes email case-insensitively, so an attacker-set unverified case-variant of the victim's email collides with the victim account on login.
**Steps:**
1. Intercept login POST to `cognito-idp.us-east-1.amazonaws.com` with `USER_PASSWORD_AUTH`, ClientId `3ck15a1ov4f0d3o97vs3tbjb52`, attacker creds; capture `AccessToken`.
2. Call `aws cognito-idp update-user-attributes --region us-east-1 --access-token <tok> --user-attributes Name=email,Value=flickr-Benign@lauritz-holtmann.de` (case-variant of victim email).
3. Confirm `email_verified` is now `false` via `get-user`.
4. Log in at Flickr with the case-variant victim email and the attacker's password, preserving capitalization in the outgoing request.
5. Flickr normalizes the email and authenticates the session as the victim account.
**How found:** Noticed Flickr blocks email changes in UI but the Cognito User Pool API still allows update-user-attributes; observed email matching is case-sensitive and email_verified is not enforced at login, hypothesizing a normalization collision.
**Exploitation:** Attacker registers/controls any account, obtains a Cognito access token, rewrites their own email attribute to a case-variant of the victim's email (unverified), then logs in to Flickr with that exact capitalization and their own password, landing in the victim's account with no user interaction.
**Insight:** When a SaaS app delegates auth to Cognito, test the raw User Pool API directly (update-user-attributes, get-user) for attributes the UI forbids, and probe case/unicode variants of identifiers to find normalization collisions between the IdP and the app's login matching.