# Ability to verify any email address you don't own - accounts.shopify.com

Email-change resend link on accounts.shopify.com leaked the confirmation token in the URL, letting a user verify any email address they don't own.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2019-11-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/229619
- Library page: https://bugbountylibrary.com/r/h1%3A229619
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:auth-bypass vuln:business-logic vuln:secrets-leak

**Target:** accounts.shopify.com email change flow
**Root cause:** The resend-verification link exposed the email-change confirmation token in the URL path, and visiting the token URL directly confirmed the change without requiring ownership of the target email.
**Steps:**
1. Login to `https://accounts.shopify.com/account`
2. Click Change next to email and enter any email address you don't own
3. Observe 'Verification email sent' message with a resend link
4. Copy the resend link: `https://accounts.shopify.com/email-change/<Confirmation-TOKEN>/resend`
5. Visit `https://accounts.shopify.com/email-change/<Confirmation-TOKEN>/` to confirm the email without owning it
**How found:** Researcher noticed the resend-verification link in the UI contained the confirmation token in its path, then hypothesized the token URL itself would confirm the change.
**Exploitation:** Attacker changes account email to a victim's address, extracts the confirmation token from the resend link shown in the UI, and navigates to the token URL to complete verification without access to the victim's inbox.
**Insight:** When a UI surfaces a resend/action link, inspect its URL for embedded tokens; if the token appears in a GET-able path, test whether visiting the bare token URL performs the state change without the email round-trip.