account-takeover 9
- Broken Access Control Leads to Account Takeover | Granted
- Weak OTP Verification Leads to Account Takeover | Comical
- Cross-Site Request Forgery Leads to Account Takeover | Crossed
- Password Reset Poisoning via Referer Header Injection | Grifted
- IDOR in Password Reset API Leads to Administrator Account Takeover | TheForms
- Password Change IDOR Leads to Administrator Account Takeover | Noted
- Weak Password Reset – Brute Force of 4-Digit Reset Token Leading to Account Takeover | Heartwood Outfitters
- OTP Bypass & Brute Force – Admin Account Takeover via Password Reset | Cheesy Does it
- Broken Authentication – Predictable Timestamp Token Leads to Admin Account Takeover | Sokudo