# Login CSRF can be bypassed (Similar approach to previous one).

IRCCloud's login CSRF token endpoint issued tokens to unauthenticated requests, letting an attacker forge a login form and log victims into the attacker's account.

- Payout: hidden
- Severity: medium
- Program: IRCCloud
- Found by: uname
- Disclosed: 2014-05-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/7531
- Library page: https://bugbountylibrary.com/r/h1%3A7531
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:auth-bypass vuln:csrf

**Target:** Login form / auth-formtoken endpoint
**Root cause:** The CSRF token endpoint /chat/auth-formtoken returns a valid token to any unauthenticated request (empty session cookie), so the token is not bound to the victim's session and provides no protection.
**Steps:**
1. Send `POST /chat/auth-formtoken` with `Cookie: session=` and body `_reqid=1` to receive a valid token, e.g. `1397481736.3b1f59ae47e1a139e8a631b2589dfae2`.
2. Build an HTML form POSTing to `https://www.irccloud.com/chat/login` with attacker email/password, `org_invite=`, the obtained `token`, and `_reqid=2`.
3. Lure victim to submit the form; victim is logged into the attacker's account.
**How found:** Observed that the token-fetch endpoint accepted requests with an empty session cookie, hypothesizing the token was not tied to a session and could be pre-obtained by the attacker.
**Exploitation:** Attacker fetches a token anonymously, embeds it in a cross-site auto-submitting form targeting /chat/login with their own credentials, and the victim's browser logs into the attacker's account (login CSRF), enabling later victim actions to be observed in the attacker's session.
**Insight:** Test whether CSRF token endpoints issue tokens to unauthenticated/empty-session requests; if the token isn't bound to the victim's session cookie, login CSRF protection is defeated.