Expected Findings
- Email change does not require the current password or step-up auth.
- Old email is not notified.
- Reset link goes to the new email immediately.
Account Takeover
Email Change No Reauth
Changing the account email requires only a session cookie, not the current password, so a stolen session lets the attacker rotate the email and trigger a password reset to take over.
CWE-287CWE-862
ATO chain
Primary Flows
- Change email POST new email, no reauth
- Trigger reset Reset to new email
Signals
Bug
// no password check before updating email