# Reset any password

pixiv's password reset verified a 6-digit email code at the final step without rate limiting, allowing brute force to reset any user's password.

- Payout: hidden
- Severity: high
- Program: pixiv
- Found by: noxxxx
- Disclosed: 2021-03-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/703972
- Library page: https://bugbountylibrary.com/r/h1%3A703972
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:race-window vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** Password reset flow (reminder.php) verification code endpoint
**Root cause:** The final password-reset step re-validates the 6-digit email verification code server-side but applies no submission/attempt limit, unlike earlier steps.
**Steps:**
1. POST email to `https://www.pixiv.net/reminder.php` and submit to trigger code send
2. Observe earlier steps rate-limit code guesses but the final reset step does not
3. Complete flow to final step with a valid code to reach the unthrottled verification
4. Brute force the 6-digit code at the final step using params `tt`, `code_id`, `code`, `phpsession` via script
5. Submit correct guessed code to set a new password for the victim
**How found:** Tester noticed earlier reset steps blocked repeated code guesses, then checked the third/final step and found the code was still validated there without submission limits, implying brute-forceability.
**Exploitation:** Attacker initiates password reset for victim email, then brute-forces the 6-digit code at the final step (no attempt limit) using a Python script with tt/code_id/code/phpsession parameters, then sets a new password.
**Insight:** When a multi-step flow rate-limits code checks in early steps, verify whether the final step re-validates the same code independently — throttling often isn't replicated on the last endpoint.