# Insufficient validation on Digits bridge

Digits bridge accepted empty Referer, letting any site call getLoginStatus() with another app's key and steal victims' OAuth credentials.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2020-08-20
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/168116
- Library page: https://bugbountylibrary.com/r/h1%3A168116
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** OAuth login bridge iframe (digits.com/bridge) using postMessage
**Root cause:** Bridge validated the HTTP Referer against the app's registered domain but treated a missing/empty Referer as valid, so any page suppressing Referer passed the check.
**Steps:**
1. Victim logs into Digits with a phone number tied to a Periscope account.
2. Attacker page includes `<meta name="referrer" content="never">` to suppress the Referer header.
3. Page embeds iframe `https://www.digits.com/bridge` and calls `getLoginStatus()` via `postMessage()` using the victim app's key.
4. Empty Referer passes validation; bridge returns the victim's OAuth credentials to the attacker page.
5. Attacker uses stolen OAuth token to act as victim (PoC renamed the Periscope account to 'Pwn3d').
**How found:** Noticed the bridge relies on Referer for origin validation; hypothesized that an absent Referer would be treated as valid, and confirmed a page can strip Referer via the meta referrer tag.
**Exploitation:** Attacker hosts a page that suppresses Referer, embeds the Digits bridge iframe, invokes getLoginStatus() with a target app's key, and receives the victim's OAuth credentials via postMessage, then uses them to perform actions on the victim's behalf.
**Insight:** When an origin check compares Referer to an allowlist, test the empty/missing-Referer case: `<meta name="referrer" content="never">` or `Referrer-Policy: no-referrer` can turn a strict-looking check into a bypass.