Impersonation of Amplenote Identities in User Invitations
linkResolution: ❌
Reports that do not describe a security issue
linkReport
Summary
An attacker can create an account using email addresses belonging to the Amplenote domain (e.g., security@amplenote.com, hello@amplenote.com) and use these identities in user-facing features such as invitations.
These identities are displayed to recipients, creating the appearance that the invitation originates from a trusted Amplenote-associated email address.
Steps to Reproduce
Navigate to the Amplenote signup page
Register a new account using an email such as security@amplenote.com
Complete the registration process
Use the account to send an invitation to another user
The recipient receives an invitation indicating it was sent by security@amplenote.com
Impact
This issue enables an attacker to impersonate trusted Amplenote email identities in real user interactions.
For example:
An attacker registers using security@amplenote.com
Sends invitations to users
The invitation presents the attacker-controlled identity as a trusted source
Because such email addresses are commonly associated with official communication, recipients may reasonably trust these invitations. This creates a realistic risk of user deception and misuse of platform trust.
This is a practical and reproducible issue that affects identity integrity and user trust within the platform.
Proof of Concept
Relevant screenshots have been attached for reference.
