# Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form

Embedded submission form endpoint skipped program-level authorization checks, letting users without 2FA or on the reporter blacklist submit reports anyway.

- Payout: $10,000
- Severity: medium
- Program: HackerOne
- Credited: japz
- Disclosed: 2018-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/418767
- Library page: https://bugbountylibrary.com/r/h1%3A418767
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:recon vuln:access-control vuln:auth-bypass vuln:business-logic vuln:mfa-bypass

**Target:** Embedded submission form endpoint
**Root cause:** The embedded_submissions/new endpoint did not enforce the same program submission requirements (2FA, rate limit, blacklist) that the standard report submission flow enforced.
**Steps:**
1. Remove 2FA from your account.
2. Visit https://hackerone.com/parrot_sec and click Submit Report; observe 2FA block.
3. Extract embedded submission URL from policy page: `https://hackerone.com/0a1e1f11-257e-4b46-b949-c7151212ffbb/embedded_submissions/new`.
4. Submit report via that embedded form; submission succeeds without 2FA.
**How found:** Researcher noticed the program enforced 2FA on the normal submit flow, then hypothesized the alternate embedded submission entry point might not share the same authorization checks and tested it.
**Exploitation:** Attacker with no 2FA (or blacklisted) navigates directly to the program's embedded submission URL and submits a report, bypassing the enforced submission requirements.
**Escalation:** Same missing authorization also bypassed report rate limits and internal abuse limits; investigation of root cause surfaced a second bug exposing other users' in-progress report attachments.
**Insight:** When a platform enforces policy on one submission path, enumerate alternate entry points (embedded forms, API endpoints, mobile clients) that may implement the same action without the shared authorization middleware.