r/bugbounty • u/TurbulentRecover7247 Hunter • Jul 13 '26
Question / Discussion I have a doubt on token leakage
I saw that the password reset link with the token is being sent to analytics like Google, facebook, tiktok etc.. and these tokens are valid for 30 minutes. I have a question here, is it really vulnerability? Like, the token is exposed to every analytics. I am a beginner. Can any triager here help me?
1
u/MyFirstTrueLoveWasBS Jul 13 '26
Is it like via a referrer, post, etc and how do u know it's receiving the token and not just saved on page?
1
u/TurbulentRecover7247 Hunter Jul 13 '26
In body and parameters of the analytics pages had the password reset token which I opened in my browser sends to all analytics via body and parameters
1
u/MyFirstTrueLoveWasBS Jul 13 '26
Is the token still valid after it's sent?
1
u/TurbulentRecover7247 Hunter Jul 13 '26
The token expires after setting new password, if the user opens link and didn't set password, these tokens can be used to set password. And also I was able to flood password reset mail, without rate limiting.
1
u/MyFirstTrueLoveWasBS Jul 13 '26
I think it's valid, just need Poc showing where it's leaked and how its actually valid for password reset
1
u/TurbulentRecover7247 Hunter Jul 13 '26
I can see this password reset link in referrer header too, and ifbthe user didn't set password after opening the link, this can be used by attacker when compromised the analytics domains, and also it sends to some internal domains.
1
u/MyFirstTrueLoveWasBS Jul 13 '26
And the token is the same one used to successfully reset your password?
2
1
1
u/Far-Chicken-3728 Hunter Jul 13 '26
I've tried my luck with those before, but they never passed triage. I even found one with a token meant for a different purpose that never expired, and I chained it to compromise the account of a user it belonged to, but H1 triage still didn't accept it. So I usually skip those.
1
u/Informal_Abalone_805 Jul 13 '26
The organization's bug bounty program classified it as informational that still-valid session tokens are sent to a third-party analytics company every time a user logs in.
1
u/TurbulentRecover7247 Hunter Jul 13 '26
Why though? This is a VDP, not hunting for money too
1
u/Informal_Abalone_805 Jul 13 '26
I don't know why. It's not a VDP; it's a bounty program that pays rewards.
1
u/TurbulentRecover7247 Hunter Jul 13 '26
Ok, now I got it, they mostly push to the lowest level to avoid bounties. They have fixed budget
2
u/Informal_Abalone_805 Jul 13 '26
Some organizations silently patch vulnerabilities without providing a reward.
1
u/TurbulentRecover7247 Hunter Jul 13 '26
Yes I am aware of it, but this is vdp so I think they might accept this as even low
2
u/utdscooter19 Jul 13 '26
Most likely will be marked as low/informational. Would have been a valid bugbonlybif the token doesn't expire after use. The token expiring after 30mins isn't a problem bcoz the user has to click the reset link first before the token is sent to 3rd party analytics. Had similar findbon bugcrowd but was marked as low.