|
Task Description
When logging into https://admin.alwaysdata.com, the application issues a 302 redirect containing sensitive authentication parameters (user_id and token) directly in the URL.
This login URL can be reused multiple times, from any browser, any device, and any location, even after the user logs out. As a result, anyone in possession of this URL can gain full access to the victim’s account without credentials.
Affected Endpoint
https://admin.alwaysdata.com/login/?user_id={USER_ID}&token={TOKEN}
Vulnerability Class
Steps to Reproduce
Navigate to:
https://admin.alwaysdata.com/
Authenticate with valid credentials.
Upon successful login, observe the HTTP response:
HTTP/2 302 Found
Location: /login/?user_id=425062&token=1767520125-e3a2cf1655e9da2b0a3f
Step 3: Use the login URL directly
Open the redirected URL manually:
https://admin.alwaysdata.com/login/?user_id=425062&token=1767520125-e3a2cf1655e9da2b0a3f
✅ You are logged into the account without entering credentials.
Log out from the account normally.
Step 5: Replay the same URL
Open an incognito/private window
Or use a different browser
Or access from a different machine
Paste the same URL again:
https://admin.alwaysdata.com/login/?user_id=425062&token=1767520125-e3a2cf1655e9da2b0a3f
You are logged in again, successfully.
Expected Behavior
Actual Behavior
Login token:
Token is exposed in:
Impact
Full account takeover if the URL is leaked
High risk of accidental exposure via:
This is effectively a permanent authentication backdoor as long as the token remains valid.
Severity
Do not place authentication tokens in URLs
Replace with:
Secure, HTTP-only cookies
Ensure login tokens are:
Bind tokens to:
Rotate tokens immediately after use
|
