# Improper Authentication - any user can login as other user with otp/logout & otp/login

Snapchat OTP logout endpoint trusted client-supplied user_id, returning a victim's OTP token that enabled full account takeover via /scauth/otp/login.

- Payout: hidden
- Severity: critical
- Program: Snapchat
- Found by: korniltsev
- Disclosed: 2021-09-03
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/921780
- Library page: https://bugbountylibrary.com/r/h1%3A921780
- Tags: area:mobile domain:api domain:mobile impact:ato kind:bounty platform:hackerone sev:critical technique:param-pollution vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** app.snapchat.com OTP auth API (/scauth/otp/droid/logout, /scauth/otp/login)
**Root cause:** The logout endpoint accepted a client-supplied user_id instead of deriving it from the authenticated session, and issued an OTP token for that arbitrary user_id.
**Steps:**
1. Log in as attacker to obtain valid session headers (X-Snapchat-Client-Auth, req_token, timestamp).
2. Send `POST /scauth/otp/droid/logout` with body `{"user_id":"<victim_id>","device_id":"...","device_name":"..."}`.
3. Response returns `{"status":"SUCCESS","user_id":"<victim_id>","token":"<otp_token>"}`.
4. Send `POST /scauth/otp/login` with `username=<victim>&token=<otp_token>` and other device params.
5. Response returns victim's access/refresh tokens and `logged:true` profile.
**How found:** Noticed the logout request carries a user_id parameter normally equal to the caller's own id; hypothesized the server trusts it and tried substituting the victim's user_id, observing the response returned the victim's id and a token.
**Exploitation:** Attacker with any valid account and the victim's user_id (obtainable via friends request) calls logout with victim's user_id to mint an OTP token, then submits it to /scauth/otp/login to receive victim session tokens, achieving full account takeover.
**Insight:** On mobile auth APIs, endpoints that take a user_id in the body (logout, device registration, OTP flows) may trust it over the session; swap in another user's id and check whether the response echoes it and mints a token for that account.