Security vulnerabilities

  • Status Closed
  • Assigned To
    hdegorce
  • Private
Attached to Project: Security vulnerabilities
Opened by stan - 25.08.2026
Last edited by hdegorce - 26.08.2026

FS#463 - Transitive Bypass of Credit Card Verification via Nested Profile Invitations

1. Summary
Alwaysdata requires users to link a credit card during standard public registration (/register/). This check prevents automated free-tier abuse and disposable botnet setup.

An inconsistent check exists in the profile invitation feature (/permissions/add/):

An existing account owner (User A) invites an email address (User B) with zero permissions.
User B confirms the email link, sets a password, and enters basic profile information (address and phone number) without any credit card or OTP verification.
User B opens admin.alwaysdata.com and creates an independent free hosting account (1GB disk, 256MB RAM, 0.25 CPU, dedicated SSH, public IP, HTTP server) directly from the panel without ever being asked for a credit card.
This behavior is transitive. User B can then invite User C, who completes the same onboarding flow (password, address, phone) and creates another free hosting account without linking a payment card.
This chain allows someone with a single verified account to create unlimited independent free hosting accounts without linking a payment card to the new accounts.

2. Technical Details
The Logic Gap
Alwaysdata separates user identities (Profiles) from compute containers (Accounts).

Public registration flow: A visitor fills out the registration form, links a credit card, and the system provisions an account.
Invitation flow: When a user registers through an invite link, the onboarding form asks for a password, name, address, and phone number, but completely skips the credit card step. Once logged in, the admin panel allows the user to provision a new free hosting account without checking for a payment card on file.
Public Registration:
User → Public Form → Credit Card Check → Free Account Created

Invitation Chain:
User A (Verified)

  1. > Invites User B (0 perms)
    1. > User B confirms email, sets password, enters address and phone (No card check)
    2. > User B opens panel and creates Free Account (e.g., ssh-zerr9)
    3. > User B invites User C
      1. > User C confirms email, sets password, enters address and phone (No card check)
      2. > User C opens panel and creates Free Account

3. Impact
Unbounded Free Hosting Creation: A user can create multiple independent hosting accounts with active SSH, custom domains, web services, and database instances without linking a credit card to each account.
Missing Payment Accountability: Downstream accounts created through the invitation chain have no financial record on file. If these accounts run abusive scripts or phishing pages, Alwaysdata cannot trace them back to a payment method.
4. Steps to Reproduce
Log in to https://admin.alwaysdata.com/ using an existing account (User A).
Go to https://admin.alwaysdata.com/permissions/add/.
Enter a new email address (User B), uncheck all permission boxes, and submit the form.
Open the confirmation link sent to User B. Set a password and fill in the address and phone number fields. Notice that the registration finishes without asking for a credit card or SMS OTP.
Log in to https://admin.alwaysdata.com/ as User B.
From the dashboard, click to create a new account, select the Free plan (1GB disk, 256MB RAM), and confirm.
Confirm that the account provisions immediately with full SSH and web access (e.g., ssh-zerr9.alwaysdata.net).
While logged in as User B, go to /permissions/add/ and invite User C.
Have User C confirm their email, complete the password and address setup, log in, and create another free account. The account provisions without asking for a credit card.
5. Suggested Remediation
Check Payment Details on Account Creation: Require a linked credit card on the account creation action itself (/account/add/), not just on the public registration form.
Restrict Invited Profiles: Require invited collaborator profiles to add and verify a payment method before they can spin up standalone hosting accounts.
Limit Invitation Permissions: Only allow profiles with verified payment details to send out new user invitations.

Closed by  hdegorce
26.08.2026 12:12
Reason for closing:  Invalid
Additional comments about closing:  

Creating a profile from another profile is necessarily legitimate since the first profile is legitimate by having been validated.

Admin
hdegorce commented on 26.08.2026 11:48

Hello,

I'm not sure to understand. We do not require to add a credit card during standard public registration. If you need to add a credit card it's because you lifted a "red flag".

stan commented on 26.08.2026 11:56

Thank you for the clarification. I understand that credit card verification is not universal but is triggered by a red flag in your anti-fraud system.

However, this is precisely the issue: my account was flagged by your system (correctly identifying suspicious activity), yet I was able to completely bypass this fraud detection by receiving an invitation from another account. Through the invite flow, I registered a new profile, provisioned a free hosting account with full SSH and web access, and was never subjected to the credit card verification that your system had determined was necessary.

The red flag exists for a reason — to prevent abuse. The invitation flow circumvents it entirely. A flagged actor only needs access to one clean account to invite themselves with a different email, bypassing the fraud gate your system intentionally raised.

To summarize: this is not about whether CC verification is mandatory for all users. It is about the fact that your risk-based fraud detection can be trivially bypassed via the profile invitation mechanism.

Steps: (1) Register normally → flagged → CC required. (2) Get invited via /permissions/add/ from any existing account → complete registration without CC → provision free server. The flag is never re-evaluated in the invite flow.

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing