Insecure Direct Object Reference (IDOR) (CWE-639)CVSS 7.5€400 PRO
Wildcard Account Lookup and Unsalted Hash Identifiers Defeat PII Masking
An account-recovery API interpreted the supplied email selector as a wildcard pattern, allowing unauthenticated enumeration of arbitrary users. Although email addresses and phone numbers were visually masked, the API returned unsalted SHA-256 identifiers derived directly from the original values, making the masked PII recoverable. The report was accepted as High with CVSS 7.5 and rewarded with €400.
Description
An account-recovery API accepted an email-like selector as a path parameter and returned the security media associated with the matching account, such as a masked email address and masked mobile number.
The endpoint had three weaknesses that became significantly more serious when chained:
- The frontend publicly exposed the client identifier required to call the API.
- The
{email}path value was interpreted as a glob pattern, not an exact account identifier. - Each masked value was returned together with an
idequal to the unsaltedSHA-256digest of the original plaintext value.