# “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expired

MFA bypass by flipping mode from sms to email and secureLogin to false in the login POST, skipping phone code when device trust cookie is valid.

- Payout: $2,500
- Severity: medium
- Program: Superhuman (formerly Grammarly)
- Credited: l1nkworld
- Disclosed: 2019-08-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/665722
- Library page: https://bugbountylibrary.com/r/h1%3A665722
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:rest technique:param-pollution vuln:access-control vuln:auth-bypass vuln:mfa-bypass

**Target:** auth.grammarly.com /v3/api/login MFA endpoint
**Root cause:** Server trusted client-supplied mode and secureLogin fields to decide MFA enforcement, and the email mode combined with secureLogin:false skipped the phone-code check when a valid device-trust (tdi) cookie was present.
**Steps:**
1. Enable MFA on account and log in with email+password
2. At MFA prompt enter any random code and intercept POST `auth.grammarly.com/v3/api/login`
3. Change `"mode":"sms"` to `"mode":"email"` and `"secureLogin":true` to `"secureLogin":false`
4. Forward request; session is granted without valid phone code
**How found:** Researcher noticed the MFA POST body carried client-controlled `mode` and `secureLogin` fields and hypothesized the server would honor an alternate mode (email) with secureLogin disabled to skip the phone-code check.
**Exploitation:** Attacker needs victim's httponly;secure `tdi` device-trust cookie, victim's UserAgent, and to send the crafted request within a fixed window after victim signed in from that device; then flips mode/secureLogin to obtain an authenticated session without the SMS code.
**Insight:** When an MFA challenge request includes mode/flag fields, try swapping the factor type and toggling trust flags (secureLogin:false) to see if the server re-evaluates enforcement instead of binding the challenge to the originally issued factor.