# Secrets reflected into readable channels

Verification codes or tokens copied into tickets, logs or replies another party can read

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $3,134; latest 2023-01-03. Updated 2026-10-23._

## How it works
A secret meant for one party (a verification code, password, or token) is copied into a channel a different party can read. The broken assumption is that the destination is private or trusted: an email alias that posts inbound mail as a public comment, a ticket feature that lets a sender append content, or a code-generation endpoint reachable before authentication. Once the secret lands in the readable channel, the attacker completes the flow as the victim. Two sibling sub-cases share the same broken trust but not the reflection: an auth cache that returns success without re-checking the secret [E3](https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md), and a TOTP endpoint that hands out codes pre-auth [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md).

## Where it shows up
- Email-to-ticket or email-to-comment gateways that publish inbound mail, including aliases like `system+id@domain` [E4]
- Verification or reset codes sent to addresses that are actually public sinks [E4]
- Per-ticket hash features that let a sender append content to a ticket, plus CC to a verifier's no-reply address [E2](https://bugbountylibrary.com/r/h1%3A498964.md)
- Auth caches keyed on a user-supplied identifier that store no secret hash, so cache hits skip comparison [E3](https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md)
- SSO endpoints that generate TOTP codes keyed by user ID, chained into the forgot-password flow [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md)

## How to review
Trace every secret from generation to consumption and confirm each hop is readable only by the intended party. The invariant: a verification code or token must never be written to any store or channel a different principal can read, and no auth decision may succeed without comparing the secret. Check that signup/reset flows reject or neutralize aliases that reflect mail publicly, and detect outbound mail to public sinks [E4][E2](https://bugbountylibrary.com/r/h1%3A498964.md); that auth caches key on a trusted identifier and retain the hash needed to re-verify on every hit [E3](https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md); and that code-generation endpoints are not reachable pre-auth [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md).

## Variants seen
- Verification code reflected through an issue-tracker email gateway, enabling signup as a corporate address [E4]
- Zendesk ticket-hash plus CC to a no-reply verifier surfacing a Google verification email publicly [E2](https://bugbountylibrary.com/r/h1%3A498964.md)
- API key cache keyed on sequential key_id skipping `hmac.compare_digest` on hits [E3](https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md)
- TOTP endpoint leaking codes for SSO reset, chained with wildcard user enumeration [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md)

## Why fixes fail
E4 notes the researcher bypassed a previous patch, and E2 shows the known alias block (`support+*`) was sidestepped via a different ticket feature. Alias-reflection fixes must be re-tested against the same flow after remediation [E4][E2](https://bugbountylibrary.com/r/h1%3A498964.md).

## Impact and severity
Account takeover and impersonation of a corporate identity [E4][E2](https://bugbountylibrary.com/r/h1%3A498964.md); full auth bypass [E3](https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md); SSO account takeover [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md). Severity rises with the privilege of the leaked secret and how public the reflecting channel is.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asamcurry-net-web-hackers-vs-the-auto-industry.md
- E2: https://bugbountylibrary.com/r/h1%3A498964.md
- E3: https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html.md