# Reset token not bound to account

Reset/verify flows where the account comes from client input, not the token's server-side record

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; 2 confirmed bounties: $4,000 and $6,000; latest 2021-09-03. Updated 2026-10-23._

## How it works
The flow carries two things: a secret (token, session, OTP) and an identifier (email, uuid, user_id). The root cause is that the server resolves the account from the client-supplied identifier instead of from the record the secret points to. The secret then proves nothing about which account it belongs to, so whoever controls the identifier controls whose account changes. The broken assumption: the identifier and the secret are always presented together by the same legitimate user, and the identifier is trustworthy.

## Where it shows up
- Reset/verify handlers that read `email`, `uuid`, `user[id]` from the request and look up the account from it, not from the token record [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md)[E4](https://bugbountylibrary.com/r/h1%3A910300.md).
- Auth APIs (logout, OTP, device registration) that take a `user_id` in the body and act on it instead of the session's user [E2](https://bugbountylibrary.com/r/h1%3A921780.md).
- Staging or alternate-host endpoints that bind a session to an arbitrary account, where that cookie is accepted by production [E1](https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover.md).
- A token present alongside a separate, unvalidated identifier parameter [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md)[E4](https://bugbountylibrary.com/r/h1%3A910300.md).

## How to review
Invariant: the account acted on must be derived solely from the server-side record the token/session points to; any client-supplied identifier must be compared for equality against that record and rejected on mismatch. Trace the handler: where does the target account come from? If from request input, it is unsafe. Concretely, take a token from your own account, swap in a victim's identifier, and confirm the server rejects it. Check the token is single-use and scoped to one account. Check whether staging and production share a session store [E1](https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover.md).

## Variants seen
- Staging IDOR sets arbitrary email; session reused on production [E1](https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover.md).
- Logout/OTP endpoint trusts client `user_id`, issues victim's OTP [E2](https://bugbountylibrary.com/r/h1%3A921780.md).
- Reset trusts client `uuid` not bound to the sign token [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md).
- Email verification trusts client-editable email, not the token's server-side email [E4](https://bugbountylibrary.com/r/h1%3A910300.md).

## Impact and severity
Full account takeover, including admin and employee accounts [E2](https://bugbountylibrary.com/r/h1%3A921780.md) and permanent takeover [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md). Severity rises when the target is privileged [E2](https://bugbountylibrary.com/r/h1%3A921780.md) or the takeover is permanent [E3](https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md). Bounties in evidence: 6000 [E1](https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover.md), 4000-6000 range across paid reports.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover.md
- E2: https://bugbountylibrary.com/r/h1%3A921780.md
- E3: https://bugbountylibrary.com/r/blog%3Asamcurry-net-permanent-account-takeover-on-yahoo-small-business.md
- E4: https://bugbountylibrary.com/r/h1%3A910300.md