# Узнаем несколько цифр номера телефона юзера (можно флудить смс), всего раз узнав его remixsid и его ид юзера, и установка оффлайна юзерам.

Stale remixsid sessions never expired, letting an attacker with an old session cookie repeatedly query partial phone digits and send SMS to a user.

- Payout: $300
- Severity: high
- Program: VK.com
- Credited: povargek
- Disclosed: 2019-05-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/390126
- Library page: https://bugbountylibrary.com/r/h1%3A390126
- Tags: domain:web impact:dos impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest technique:incomplete-fix vuln:auth-bypass vuln:dos vuln:info-disclosure

**Target:** VK.com session/auth endpoints (remixsid cookie, notifier.php, queuev4)
**Root cause:** Session tokens (remixsid) were not invalidated on session reset, so an old cookie from ~May 2016 remained valid for phone-number partial disclosure and SMS sending.
**Steps:**
1. Obtain a user's `remixsid` cookie and user id once.
2. Reuse the same `remixsid` after the victim resets sessions; it still works.
3. Query the phone-number partial-disclosure endpoint to learn several digits of the victim's phone.
4. Send SMS with a link to `https://vk.com/mobile` to the victim, repeatable (SMS flooding).
5. With only a user id, set the victim's status to offline and reset their queue keys, forcing `/notifier.php?act=a_get_key` and hitting its rate limit to disable queuev4 realtime events.
**How found:** Researcher noticed old remixsid cookies still worked after session resets, then tested what actions remained authorized with the stale token and with only a user id.
**Exploitation:** Attacker holding a leaked/old remixsid cookie bypasses session-reset expectations: repeatedly extracts partial phone digits and triggers SMS to the victim's number. Separately, knowing only a user id, attacker forces offline status and queue-key resets, exhausting the notifier rate limit and cutting off realtime events (except private messages).
**Escalation:** Chained partial phone disclosure with SMS sending to enable phishing/flooding; queue-key reset caused DoS on realtime notifications for arbitrary users by id alone.
**Insight:** Test whether session tokens survive 'logout all sessions'/password reset for auxiliary endpoints (SMS, phone lookup, notifier) — auth checks are often weaker there than on the main site. Also probe notifier key endpoints for rate-limit abuse triggered by attacker-controlled state resets.