[Duplicate] Unauthorized Access to PII via Improper Authentication in Registration Endpoint
An improper authentication flaw in the registration endpoint allows attackers to obtain a session token without credentials, enabling unauthorized access to sensitive personal information such as full name, birth date, and address.
Summary
An improper authentication vulnerability was identified in a registration endpoint, allowing attackers to obtain a session token without any credentials. This token can then be used to access sensitive personal information, including full name, birth date, and address, bypassing authentication controls.
Affected Component
The vulnerability affects the registration endpoint at https://[REDACTED-HOST]/bffa/retail/odata/registrationclient/getclientdata, specifically through the TokenKey header.
Root Cause
The root cause of this vulnerability is the lack of proper authentication checks in the litelogin endpoint. This endpoint issues a valid session token (TokenKey) based solely on a document number (DNI) without requiring any form of authentication, such as a password or OTP. This token is then accepted by the getclientdata endpoint, allowing unauthorized access to personal information.