
Improper Access Control - Generic (CWE-284)CVSS 6.4€0
2FA requirement bypass when inviting team members
0x7ashish
Disclosed on HackerOne · February 28, 2026
Publicly disclosed report · by 0x7ashish
View original on HackerOneSummary:
The application requires users to enable 2FA before sending team invitations. However, this restriction can be bypassed by modifying client-side responses (match and replace from false to true). This allows invitations to be sent without enabling 2FA, defeating the security requirement.
Steps To Reproduce:
-
Sign up / log in to the application.
-
Go to the Team section.
-
Try to invite a new member → the application blocks the request, requiring 2FA.
