# Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)

Uber's passwordless-signup endpoint let anyone set a new password for any user knowing only their phone number, enabling account takeover.

- Payout: hidden
- Severity: critical
- Program: Uber
- Found by: mongo
- Disclosed: 2016-07-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/143717
- Library page: https://bugbountylibrary.com/r/h1%3A143717
- Tags: area:web domain:api impact:ato kind:bounty platform:hackerone sev:critical technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** /rt/users/passwordless-signup endpoint on cn-geo1.uber.com
**Root cause:** The passwordless-signup state machine accepted a CREATE_NEW_PASSWORD state with a new password for an existing account identified only by phone number, without verifying ownership of that phone number.
**Steps:**
1. Create a new Rider account to learn the request shape.
2. Send `POST /rt/users/passwordless-signup` with JSON body `{"phoneNumberE164":"+xxxxxxxx","userWorkflow":"PASSWORDLESS_SIGNUP","userRole":"client","mobileCountryISO2":"XX","state":"CREATE_NEW_PASSWORD","newPasswordData":{"newPassword":"12345678911a!"}}` targeting the victim's phone number.
3. Replay the request (may need to send twice) until response shows `"serverState":"SUCCEEDED"` and `"userMessage":"New password has been created."`.
4. Log in to riders.uber.com with the victim's phone number and the chosen new password.
**How found:** Researcher examined the passwordless-signup state machine and noticed the CREATE_NEW_PASSWORD state could be invoked directly for an existing phone number without an OTP/ownership check.
**Exploitation:** Attacker enumerates or knows a victim phone number, submits the passwordless-signup request with state CREATE_NEW_PASSWORD and a chosen password, then logs in as the victim on riders.uber.com.
**Insight:** On state-machine auth endpoints, try jumping directly to terminal states (e.g. CREATE_NEW_PASSWORD) for an existing identifier, skipping the OTP/verification states the client normally traverses.