Sample write-up. This case study is a placeholder illustrating the format and depth of a real engagement report. Replace with an anonymized, disclosure-approved write-up from an actual engagement once available.
Authentication Bypass via Password Reset Flow
A logic flaw in a password reset token that allowed account takeover without any user interaction.
Context
[PLACEHOLDER — Client industry, e.g. "a consumer fintech app"] requested a focused authentication and session-management review as part of a pre-launch security assessment.
Finding
The password reset flow generated a reset token client-side rather than deriving it from a server-issued secret, and the token was only checked for correct length and character set — not for whether it matched a value the server had actually issued. This meant a correctly formatted token could be forged and used to reset any account's password without ever receiving the reset email.
Impact
Full account takeover for any user, given only their email address or username — no phishing, no user interaction, and no prior access required. This is a critical-severity finding by any standard: it defeats the entire authentication boundary of the application.
Proof of concept (redacted)
[PLACEHOLDER — step-by-step PoC showing token forgery and the successful password reset request, redacted of real account data]
Remediation
The fix replaced the client-derived token with a cryptographically random, server-issued token bound to the specific account and a short expiry window, validated with a constant-time comparison against the stored value, and invalidated after first use.
Severity
CVSS 3.1: 9.8 (Critical) — Confidentiality: High, Integrity: High, Availability: None, Attack Complexity: Low, Privileges Required: None, User Interaction: None.