# Avoid "resend verification email" confusion

Crafted verify link with attacker email2 param caused victim's click on 'Resend verification email' to associate attacker's address, leaking all notifications.

- Payout: $1
- Severity: low
- Program: Gratipay
- Credited: s_p_q_r
- Disclosed: 2017-03-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/156542
- Library page: https://bugbountylibrary.com/r/h1%3A156542
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:email vuln:business-logic vuln:csrf

**Target:** Email verification endpoint (/~user/emails/verify.html)
**Root cause:** The verify page accepted an arbitrary email2 parameter and offered a 'Resend verification email' action that associated that unverified email with the victim's account without confirmation.
**Steps:**
1. Attacker registers lookalike email `a1ice@foo.com` (visually similar to `alice@foo.com`)
2. Base64-encode it: `YTFpY2VAZm9vLmNvbQ~~`
3. Send victim link `https://gratipay.com/~alice/emails/verify.html?email2=YTFpY2VAZm9vLmNvbQ~~&nonce=x`
4. Victim sees 'verification code for a1ice@foo.com is bad. Resend verification email'
5. Victim clicks Resend; attacker email gets associated and verification link sent to attacker
6. Attacker forwards verification link to victim; victim clicks; attacker email verified and receives victim's notifications
**How found:** Researcher noticed the verify page reflected an attacker-supplied email2 param and that the resend action would associate that email without prior ownership check.
**Exploitation:** Social-engineer victim into clicking a crafted verify URL then the 'Resend verification email' button, associating attacker-controlled address; attacker completes verification via forwarded link and receives all victim notifications.
**Insight:** On email-verification flows, test whether the resend/verify action trusts an email parameter from the URL rather than the session's pending-email state; lookalike-address confusion plus a one-click resend can silently bind an attacker address.