# Vine - overwrite account associated with email via android application

Vine Android signup treated emails case-insensitively for uniqueness but case-sensitively for login, letting an attacker register a caps-variant email and lock the victim out of their original account.

- Payout: $280
- Severity: medium
- Program: X / xAI
- Credited: mishre
- Disclosed: 2017-06-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/187714
- Library page: https://bugbountylibrary.com/r/h1%3A187714
- Tags: domain:mobile domain:web impact:ato impact:dos kind:bounty platform:hackerone sev:medium tech:android technique:unicode-normalization vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** Android app signup/login flow
**Root cause:** Email uniqueness check on signup is case-insensitive (or normalizes differently) while login lookup is case-sensitive, so a caps-variant email creates a second account that shadows the original for login.
**Steps:**
1. Create account with `firstaccountmail@gmail.com` / `Bla123` via Vine Android app
2. Confirm login works with that email/password
3. Create a second account using `Firstaccountmail@gmail.com` (caps anywhere) with a different password
4. Signup succeeds despite email collision
5. Attempt login with `firstaccountmail@gmail.com` / `Bla123` — fails
6. Login with `firstaccountmail@gmail.com` / second password — succeeds but lands in the second account
**How found:** Researcher noticed the signup flow accepted a case-variant of an already-registered email, then tested whether the original credentials still worked — they did not.
**Exploitation:** Attacker registers a caps-variant of the victim's email with a known password; the victim can no longer log in with their original credentials, and the attacker controls the account bound to that email string.
**Insight:** When testing signup, try case/unicode variants of an existing email or username and then re-test login with the original credentials; a mismatch between the normalization used at registration vs. authentication reveals shadow-account and lockout bugs.