# Verify any unused email address

Signup flow reused a cached onboarding task response, letting an attacker verify an arbitrary unused email using a code sent to their own email.

- Payout: $560
- Severity: medium
- Program: X / xAI
- Credited: seifelsallamy
- Disclosed: 2019-06-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/574962
- Library page: https://bugbountylibrary.com/r/h1%3A574962
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth technique:recon vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Twitter signup/onboarding flow (api.twitter.com/1.1/onboarding/task.json)
**Root cause:** The onboarding task.json response was replayable via Fiddler Autoresponder, so the email-verification step bound the attacker's own email challenge to a different target email, and the code from the attacker's inbox was accepted for the victim email.
**Steps:**
1. Enable Fiddler HTTPS capture, go to https://twitter.com/signup, capture `https://api.twitter.com/1.1/onboarding/task.json?flow_name=signup`
2. Save the raw response as UTF-8 file
3. Add Fiddler Autoresponder rule `EXACT:https://api.twitter.com/1.1/onboarding/task.json?flow_name=signup` serving the saved file, enable rules
4. Login to twitter.com with attacker account (email accessible)
5. Go to signup, enter name, choose `Use email instead`, enter victim unused email, click sign up
6. Check attacker's own inbox, copy verification code, submit it to verify the victim email, set password
**How found:** Researcher noticed the signup onboarding response could be intercepted and replayed via Fiddler Autoresponder, then tested whether the email verification code was bound to the session's email or to the claimed email.
**Exploitation:** Attacker replays the cached onboarding task response so the verification challenge is tied to their own email while the account being created claims the victim's email; the code from the attacker inbox is accepted, yielding a Twitter account with the victim's email verified.
**Escalation:** Chained into OAuth login on third-party sites that trust Twitter-verified email, enabling account takeover of victim accounts on those sites; also enables impersonation and mass verified-account spam.
**Insight:** When a multi-step signup flow returns a task/state blob, replay it and check whether the verification challenge is bound to the claimed identifier or to the session's own contact — mismatch lets you verify arbitrary emails.