- Status Closed
-
Assigned To
xlefloch - Private
Opened by monty099 - 16.02.2026
Last edited by xlefloch - 24.02.2026
FS#298 - Subscription Logic Flaw Leading to Paid Plan Bypass
Description
The business model of alwaysdata relies on restricting features based on the subscription type, where certain privileges (such as creating websites and using additional resources) are granted only to accounts with paid plans.
I was able to bypass this system by exploiting a logical flaw in the Subscription Rename mechanism and the lack of synchronization between the Mailbox state and plan validation. This resulted in obtaining all paid features using a Free account without any payment.
The issue is not UI-based, but a server-side business logic flaw.
Steps to Reproduce
1. Create a new subscription with the Free plan.
2. Using an API Token, execute a request via curl to retrieve the subscription details and confirm that the plan is Free.
3. Go to the Mailbox section and identify the email associated with the subscription (e.g.,
test@alwaysdata.net).
4. Open Burp Suite, intercept the Save request for the mailbox settings, and send it to Repeater.
5. Rename the subscription.
6. Immediately after renaming, send the previously saved request from Repeater.
7. Observe that:
The subscription name changes successfully.
However, the Mailbox remains associated with the old name (test).
8. Create a new subscription using the same old name (test).
9. Observe that the new subscription obtains:
The ability to create websites (not allowed on the Free plan).
Full paid features.
No payment method required.
No effective restrictions applied.
10. When checking the subscription via the API, it shows:
"product": null
"period": null
This indicates that the account has no enforced restrictions while effectively enjoying full paid features.
11. The issue was tested on multiple accounts and remained functional for more than a week without any payment request.
POC: https://admin.alwaysdata.com/support/92155/
Impact
Obtaining paid features without payment.
Potential unlimited abuse of paid infrastructure.
Loading...
Available keyboard shortcuts
- Alt + ⇧ Shift + l Login Dialog / Logout
- Alt + ⇧ Shift + a Add new task
- Alt + ⇧ Shift + m My searches
- Alt + ⇧ Shift + t focus taskid search
Tasklist
- o open selected task
- j move cursor down
- k move cursor up
Task Details
- n Next task
- p Previous task
- Alt + ⇧ Shift + e ↵ Enter Edit this task
- Alt + ⇧ Shift + w watch task
- Alt + ⇧ Shift + y Close Task
Task Editing
- Alt + ⇧ Shift + s save task
Hello,
The method used renders the account unusable, as it was not created correctly.
Regards,
Hello,
The account is fully functional and I am actively using all paid features without any restrictions or payment requirement. This confirms that the subscription limitations are not being properly enforced.
Regards,
I'm trying to reproduce the initial error that caused the original "ddf" account to break during the renaming process this results in you having an unrenamed email address. Are you able to reproduce it with a new account?
Hello,
Yes, I was able to reproduce the issue consistently with a new account.
Here is the exact reproduction flow using a fresh Free subscription named lim:
1. Created a Free subscription named lim.
2. Intercepted the mailbox “Save” request and sent it to Repeater.
3. Renamed the subscription from lim to bbn.
4. Sent the previously saved mailbox request.
Result:
The subscription name changed to bbn.
The mailbox remained associated with the old name (lim).
I then created a new subscription using the name lim, and it was created successfully while inheriting paid-level capabilities.
This confirms the issue is reproducible and not limited to the original "ddf" account.
POC: https://admin.alwaysdata.com/support/92155/
Regards,
Your POC concerns an account created at the end of January that has been broken; let's resume this conversion in your ticket.
A patch has been apply, do you confirm that this solves the issue?
Hello,
I tested it after the patch, and the issue is still reproducible. The behavior remains unchanged.
Regards.
Please, don't use account names that has been broken before, we will have to clean them and this will cause errors in the conclusion of your tests.
Hello,
I created a completely new account, and the issue is still reproducible.
Regards.
Hello,
After reviewing and testing again, I can confirm that the issue has been fixed.
Regards.