Summary
The application allows users to successfully create and use an account without verifying ownership of the supplied email address. During testing, an account was successfully registered using the email address:
michael@amplenote.com
No email confirmation or verification was required before the account became active and accessible.
This allows anyone to register accounts using email addresses they do not own, potentially leading to account impersonation, abuse of application features, and unreliable user identity. Many services require verification of the email address before activating an account or enabling full functionality.
Technical Description
The registration workflow does not enforce email ownership verification.
A user can submit the registration form with any valid email address, and the account is activated immediately without requiring the recipient to:
Click an email verification link.
Enter a one-time verification code.
Confirm ownership of the supplied email address.
As a result, the application trusts unverified email addresses as legitimate user identities.
Affected Endpoint
https:
Steps to Reproduce
Visit the signup page.
Enter a new email address.
During testing, the following email was used:
michael@amplenote.com
Complete the registration process.
Observe that the account is created successfully.
No email verification is required before the account becomes active.
The newly created account can be used immediately.
Working Proof of Concept
Target URL
https:
Test Email
michael@amplenote.com
Observed Result
Registration completed successfully.
Account became active immediately.
No email verification link was required.
No confirmation code was requested.
Email ownership was never validated.
Attack Scenario
An attacker can:
Register accounts using email addresses belonging to other individuals or organizations.
Impersonate legitimate users during collaboration or communication.
Abuse referral systems or free trial programs.
Generate large numbers of fake accounts using disposable or third-party email addresses.
Cause confusion when legitimate users later attempt to register using their own email address.
User Impact
Users may discover that their email address has already been registered.
Confusion regarding account ownership.
Increased risk of impersonation.
Users may not receive important notifications if an incorrect or unauthorized email address is associated with an account.
Business Impact
Increase in fake or fraudulent account registrations.
Reduced trust in the platform's identity verification process.
Higher support costs for account ownership disputes.
Potential abuse of promotional offers, referrals, or free trials.
Poor data quality due to unverified email addresses stored in the user database.
Remediation
Implement mandatory email verification before activating newly created accounts.
Recommended controls:
Send a signed, time-limited verification link to the supplied email address.
Keep newly registered accounts in an unverified state until the verification link is completed.
Restrict login or sensitive functionality until verification succeeds.
Expire verification links after a reasonable period.
Notify users when an account is created using their email address and provide an option to report unauthorized registrations.