23/09/2026
Critical Vulnerability Discovered: Account Takeover via Forgot Password (Parameter Pollution)
While testing a target's password reset functionality, I discovered a critical Account Takeover vulnerability caused by HTTP Parameter Pollution.
Steps I followed:
1️⃣ I navigated to the "Forgot Password" page and initiated a request using a valid email that I owned.
2️⃣ I intercepted the request in Burp Suite and duplicated the email parameter — adding a second email (victim's) right below the first one in the same JSON body:
{
"email": "[email protected]",
"email": "[email protected]"
}
Forwarded the modified request through Burp Suite.
4️⃣ The reset token was delivered to my own inbox — but it was valid to reset the password of the victim's account (the second email).
5️⃣ Using that token, I successfully set a new password for the victim's account — achieving full Account Takeover without any interaction from the victim.
Impact: An attacker only needs to know a victim's registered email address to fully compromise their account, bypassing the need for inbox access.
This highlights how something as simple as a duplicate parameter can break authentication logic when backend systems don't handle duplicate keys consistently.
