Vulnerability Title
Pre-Account Takeover via Missing Email Verification during Manual Registration
Severity
Medium to High (Depending on session handling and OAuth integration behavior)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (Base Score: 8.1)
Affected Endpoint
URL: https:
Steps to Reproduce
Attacker Setup: The attacker navigates to the sign-up page and creates a manual account using the target victim's email address (e.g., victim@gmail.com) and a password of the attacker's choosing.
Dashboard Access: The platform logs the attacker in immediately without forcing email verification or blocking dashboard interactions. The attacker sets up a persistent login session or notes down the credentials.
Victim Action: Later, the victim decides to join Amplenote and clicks "Sign Up with Google" (or Apple) using their victim@gmail.com identity.
Account Merging: Because an entry for victim@gmail.com already exists in the system database, the application incorrectly authenticates the victim into the attacker-created workspace without generating a collision error or forcing the victim to claim ownership through a verification process.
Data Compromise: The victim believes they are using a fresh, private account and begins logging sensitive notes. The attacker utilizes their concurrent persistent session or password to read, edit, or exfiltrate the victim's data.
Impact
Data Confidentiality Breach: Total access to all information, notes, schedules, and connected integrations populated by the victim post-registration.
Account Tracking: The attacker maintains ongoing, stealthy persistence within the victim's workspace.
Remediation & Mitigation Strategies
Enforce Strict Verification on Registration: Restrict dashboard access and core account functionalities until the user clicks a unique verification link sent to their registered email address.