# Account takeover of existing HackerOne accounts through SCIM provisioning

SCIM provisioning in Okta let an attacker change a victim's email to an attacker-controlled verified-domain address, then password-reset to take over the HackerOne account.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: boy_child_
- Disclosed: 2025-07-17
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3178999
- Library page: https://bugbountylibrary.com/r/h1%3A3178999
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth tech:sso technique:chained vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** api.hackerone.com SCIM provisioning via Okta
**Root cause:** SCIM sync trusted the email field independently of the username, so changing only the email to a verified-domain address updated the victim's account email without validation against the original identity or notifying the user.
**Steps:**
1. Set up sandbox program with SSO+SCIM via Okta and import users.
2. Add an Okta user with an email you control on your verified domain.
3. Import org users and assign `demo-member@hackerone.com` (or victim) to that Okta user.
4. Edit the assignment, keep username as `victim@ato.com`, change email field to `attacker@verified.com`.
5. Save; SCIM sync updates victim's email silently.
6. Trigger password reset; no notification sent to victim, reset goes to attacker email.
7. Log in as victim.
**How found:** Initial attempts to import users with mismatched domains failed or created new users; researcher noticed the username and email fields are handled separately and that keeping username unchanged while swapping email mutated the existing account instead of creating a new one.
**Exploitation:** Attacker with a verified domain and working SSO/SCIM config imports the victim (including default demo-triager/demo-member accounts present in every org), assigns them to an Okta user, changes only the email field to an attacker-controlled verified-domain address, lets SCIM sync, then performs a password reset that lands on the attacker's inbox, gaining full account access.
**Escalation:** Targets default demo-triager@hackerone.com and demo-member@hackerone.com present in every new org/sandbox, enabling takeover across many organizations.
**Insight:** In SCIM/SSO provisioning, test whether mutable attributes like email are validated against the immutable username/identity; try changing only the email to a verified-domain address while keeping the original username to hijack existing accounts, and check whether such changes trigger user notifications.