Security vulnerabilities

A Pre-Account Takeover vulnerability exists in the registration flow due to missing email
ownership verification. An attacker can register an account using the victim's email
address and enable 2FA (Two-Factor Authentication) on the account. When the victim
later tries to register or reset their password, they are blocked by the 2FA configured by the
attacker, effectively locking them out of their own account.

Pre-Account Takeover with 2FA Lockout
CWE-287: Improper Authentication
Severity: HIGH

a. Go to the registration page.
b. Use an attacker-controlled email like attacker@example.com. c. Set any password and complete the registration.
d. You will find a confirmation link sent to your inbox
e. Log in successfully.

a. Navigate to the account/profile settings page.
b. Confirm that email address can be updated manually.
c. There is no any authentication for the new account that I added manually.

a. After replacing the victim email with the attacker email
b. In profile settings before saving add a 2FA
c. Follow the instructions of the 2FA on the authenticator app

a. The attacker now owns a fully active account using the victim’s email
address.
b. The pending verification flow for the victim’s signup becomes useless.
c. The victim can no longer register or use the email.

PoC Video:
https://drive.google.com/file/d/1bKiQ4h_WuyMmYSSYCjznrYyIiNIJIsOj/view?usp=drivesdk

The attacker fully takes over an account associated with the victim’s email address.
The victim is unable to register or reset the account.
The attacker gains persistent control via 2FA.
No proof of email ownership is ever verified.

Permanent account takeover before the legitimate user signs up.
Victim is locked out of the account, even with password reset.
Brand trust & legal implications (e.g., GDPR violations).

a. Do not allow login, access to settings, or 2FA setup until the email is fully
verified.
b. Pending registrations should not be usable until email confirmation is
completed.

a. When a user updates their email in the profile:
i. Send a verification link to the new email address.
ii. Only apply the change after the user clicks the link and confirms
ownership.
iii. Until then, keep the old email active.

a. Tokens should not be generic or guessable.
b. A verification token issued to one registration flow must not work for a
different session or logged-in account.

a. Users should only be allowed to enable 2FA after confirming email
ownership to prevent account lockout abuse.

a. Enforce uniqueness and verify ownership before allowing any email to be
reused in any form (registration or profile update).

a. In case a legitimate user resets the password, all previous sessions and 2FA
setups should be invalidated unless re-verified.

a. If an email is changed, notify both the old and new addresses about the
change and offer a way to revert if unauthorized.

Thanks For Reviewing,