# StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts

Shopify Storefront API's customerAccessTokenCreate only throttled failed logins, so attackers could brute force passwords by interleaving valid attempts past the counter.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: clew
- Disclosed: 2019-10-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/708013
- Library page: https://bugbountylibrary.com/r/h1%3A708013
- Tags: area:web domain:api domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:graphql vuln:auth-bypass vuln:business-logic

**Target:** Storefront API GraphQL mutation customerAccessTokenCreate
**Root cause:** The login throttle counter was only checked and incremented when an invalid password was submitted, so valid-password attempts bypassed the limit entirely.
**Steps:**
1. Send repeated `customerAccessTokenCreate` mutations with wrong passwords until the response returns `Login attempt limit exceeded`.
2. Continue sending attempts with candidate passwords; the throttle does not block them because the counter only increments on invalid passwords.
3. When the correct password is submitted, the mutation succeeds and returns a valid customer access token.
**How found:** Researcher observed the 'Login attempt limit exceeded' error after failed attempts, then noticed that submitting the real password still succeeded, revealing the throttle only applied to invalid passwords.
**Exploitation:** Attacker repeatedly submits password guesses via the customerAccessTokenCreate mutation; the 'limit exceeded' error does not actually block further attempts, allowing continued guessing until the correct password yields a customer access token and account takeover.
**Insight:** When testing login throttles, verify the counter increments on every attempt including successful ones; a throttle that only counts failures can be bypassed by interleaving guesses and checking whether a correct guess still authenticates.