# Unverified identity in generated links

Links, calls or messages built from client-supplied email, phone or redirect URL without proving ownership

_Area: Web business logic and race conditions. Seen in 6 disclosed reports; 4 confirmed bounties, median $745, range $1-$2,000; latest 2021-09-03. Updated 2026-10-23._

## How it works
A feature builds a link, call, or message from an identity value (email, phone, redirect URL, payment token) taken from the request instead of from a verified server-side record. The code assumes the supplied value belongs to the requester. It does not. Whoever controls the parameter controls where the message goes, what it says, or which account it attaches to.

## Where it shows up
- Robocall/2FA endpoints that dial any user-supplied phone number, including premium-rate ranges [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md).
- A third-party SMS link API (POST /v1/url) whose client-supplied `data` JSON carries per-platform redirect URLs (desktop/android/ios/fallback) [E2](https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md).
- Verify pages that reflect an `email2` URL parameter and offer a "Resend verification email" action that associates it without confirmation [E3](https://bugbountylibrary.com/r/h1%3A156542.md).
- Payment method tokens placed in redirect URLs and sent to third-party analytics, then replayable across accounts [E4](https://bugbountylibrary.com/r/h1%3A637267.md).
- Rate limits keyed per-account rather than per-destination [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md).

## How to review
Trace every generated link, call, message, or token back to its source of identity. The invariant: the destination and displayed identity must come from a server-side record already proven to belong to the requester, never from a request parameter. Check that redirect URLs are constrained to owned domains [E2](https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md), that phone numbers are validated as non-premium and rate-limited per destination [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md), that resend/verify actions use session pending-email state [E3](https://bugbountylibrary.com/r/h1%3A156542.md), and that payment tokens are bound to the originating user/session [E4](https://bugbountylibrary.com/r/h1%3A637267.md). For E2, enumerate the vendor-documented redirect fields in the proxied JSON, not just the obvious one.

## Variants seen
- Premium-rate phone numbers accepted by robocall/2FA endpoints, monetized via carrier revenue [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md).
- Attacker-controlled redirect URLs in a third-party SMS link API, producing branded phishing links [E2](https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md).
- Arbitrary `email2` parameter on a verify page, associating an unverified address with the victim; lookalike-address confusion plus one-click resend [E3](https://bugbountylibrary.com/r/h1%3A156542.md).
- Payment method token in redirect URL and analytics beacon, replayable to link another user's card [E4](https://bugbountylibrary.com/r/h1%3A637267.md).

## Why fixes fail
Per-account rate limits still allow abuse across many destinations [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md). Blocking premium numbers by exact string fails against padding or country-code variants [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md). Domain allowlists for redirect URLs can be bypassed if only one platform field is checked [E2](https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md). A session-state fix for resend still leaks if the pending email is displayed without ownership proof [E3](https://bugbountylibrary.com/r/h1%3A156542.md).

## Impact and severity
Led to toll fraud and carrier revenue theft [E1](https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md), branded phishing at scale [E2](https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md), notification leakage to attacker addresses [E3](https://bugbountylibrary.com/r/h1%3A156542.md), and linking another user's credit card [E4](https://bugbountylibrary.com/r/h1%3A637267.md). Severity rises when the artifact carries the trusted brand or triggers a paid action.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-07-how-i-could-steal-money-from-instagram-google-and-microsoft.md
- E2: https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html.md
- E3: https://bugbountylibrary.com/r/h1%3A156542.md
- E4: https://bugbountylibrary.com/r/h1%3A637267.md