Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse

I received an email from the new points and rewards system stating that I had reached Level 4, and the reward was a 3-month Burp Suite Pro license (sponsored by PortSwigger). The email included a “Redeem it here” button, which redirected me to a Google Form. After filling out the form, I received a valid license in my email.

The issue is that there is no validation or verification tied to the user’s account, which allows an attacker to obtain multiple licenses simply by using different email addresses.

Evidence

Email content (relevant section):

Hi theokeen, You’ve reached Level 4!