Description
A pre-account takeover vulnerability exists in the account registration and 2FA enrollment flow that allows an attacker to lock out the legitimate owner of an email address.
During testing, I created an account using the victim's email address and configured 2FA on my own authenticator device. Later, when the legitimate owner attempted to create an account using the same email address, the application treated the email as already registered.
Even if the victim performs a password reset, the account still requires the attacker-configured 2FA verification, preventing the legitimate owner from gaining access to the account.
This results in the victim being locked out of their account due to an attacker-controlled 2FA configuration.
Steps to Reproduce
Navigate to the signup page.
Register an account using the victim's email address.
Complete the registration process.
Log in to the created account.
Enable 2FA using an attacker-controlled authenticator device.
Log out from the account.
Attempt to register a new account using the same victim email address.
Observe that the application reports that the email address is already registered.
Perform a password reset for the account.
Observe that after resetting the password, the application still requires the attacker-configured 2FA code.
The legitimate owner is unable to access the account.
Expected Behavior
An attacker should not be able to pre-register another user's email address and configure security settings such as 2FA before verifying ownership of the email address.
Actual Behavior
An attacker can register using another user's email address and enable 2FA on their own device, causing the legitimate owner to be locked out even after password recovery.
Impact
An attacker can prevent legitimate users from accessing accounts associated with their email address by pre-creating the account and binding attacker-controlled 2FA. This can lead to account takeover scenarios, denial of account access, and loss of trust in the account recovery process.