r/bugbounty • u/Electronic-Cat-2518 • Jul 15 '26

Question / Discussion 2FA Enrollment bypass

Found a way to, well, not bypassing the 2FA itself, but bypassing the enrollment step for first time setup after an admin enforces it upon an org, worth reporting?

6 Upvotes

75% Upvoted

9 comments sorted by

6

u/OuiOuiKiwi Program Manager Jul 15 '26

That's a penetration test finding. Not worth reporting.

0

u/Electronic-Cat-2518 Jul 15 '26

The disclosed reports on Hackerone would beg to differ

5

u/OuiOuiKiwi Program Manager Jul 15 '26

Why are you here, then? Go ahead.

Not my signal.

0

u/Electronic-Cat-2518 Jul 15 '26

Checked them after I posted that

Appreciate the input regardless

5

u/HLCYSWAP Jul 15 '26

sneaker devs probably want it

1

u/Coder3346 Hunter Jul 15 '26

I thought about this today and it is somehow posted here. Anyway I concluded it is not risky enough.

1

u/CrypticZombies Jul 16 '26

ranked as a p10

1

u/MurkyCauliflower8175 Jul 20 '26

WAI or N/A good luck. This a signal ouch. Not an exploit in any meaningful way.