# Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo account

Discourse's Yahoo OpenID callback lacked CSRF protection, letting an attacker link their Yahoo identity to a victim's account and log in as them.

- Payout: hidden
- Severity: high
- Program: Discourse
- Found by: avinash_
- Disclosed: 2018-12-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/423022
- Library page: https://bugbountylibrary.com/r/h1%3A423022
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:account-takeover vuln:auth-bypass vuln:csrf

**Target:** Yahoo OpenID auth callback endpoint (/auth/yahoo/callback)
**Root cause:** The Yahoo OpenID callback accepted a GET request with _method=post and no CSRF token, so a pre-generated attacker auth response could be replayed into a victim's session to bind the attacker's Yahoo identity.
**Steps:**
1. Attacker visits /u/user/preferences/account and starts Yahoo connect with Burp intercepting.
2. Capture the GET /auth/yahoo/callback?...&openid.ax.value.email=... request containing the attacker's Yahoo OpenID response, then drop it.
3. Deliver that captured request to an authenticated victim as an HTML form or URL.
4. Victim sees 'authentication complete' and is redirected to /?authComplete=true, linking attacker's Yahoo account.
5. Attacker logs in via Yahoo and is redirected to /auth/yahoo/null, then loads the site and is logged into the victim's account.
**How found:** Noticed the Yahoo connect flow used a GET request with _method=post and lacked a CSRF token, then reasoned a captured callback could be replayed cross-site into a victim session.
**Exploitation:** Attacker pre-completes Yahoo OpenID auth to obtain a valid signed callback URL, drops the request to preserve the token, then forces the victim's browser to issue that GET (via form/URL). The callback binds the attacker's Yahoo identity to the victim's Discourse account; attacker then authenticates with Yahoo to take over the account.
**Insight:** OAuth/OpenID callback endpoints that accept GET with method override and no CSRF token can be replayed: capture your own signed callback, drop it, and force a victim to load it to bind your identity to their account.