Invitation code leaked on reddit

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#140 — Invitation code leaked on reddit
This issue was discovered on FirstBlood v1

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-05-10, codersanjay Level 3 reported:


        Invitation code of a doctor was leaked on reddit with which I was able to register a doc myself.



Impact
Create doctor account and impersonate.

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/

Parameter: none

Payload: none

FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.