Other nomination
The PayPal 2FA Bypass
PayPal's servers issued fully authenticated session tokens once a username and password were accepted, before the second factor was checked, and the mobile app enforced the logout only on the client. Switching the phone to airplane mode at the right instant stopped that logout and gave complete account access without the security key.
Record
- Researcher
- Jon Oberheide
- Published by
- The Duo Security Bulletin
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Jon Oberheide, first published at the original source. Preserved copies are kept so the citation survives its host.