published August 11, 2023
⚠️ A known username and password is all it takes to dodge multi-factor authentication in EmpowerID versions before 7.205.0.1! It's like giving someone the keys to your house, only to find out they can change the locks and send your backup keys to their own address! 📦🔑 An attacker who knows the first factor could change an account's email address, which means they could receive MFA codes intended for the legitimate user. This potentially puts sensitive data at risk, allowing unauthorized access and manipulation. It's a recipe for disaster if the wrong hands get involved!
It's like giving someone the keys to your house, only to find out they can change the locks and send your backup keys to their own address! 📦🔑 This vulnerability allows an attacker to bypass MFA by altering the account's email address once they have the correct username and password, thereby redirecting MFA codes to an attacker-controlled email.
An attacker who knows the first factor could change an account's email address, which means they could receive MFA codes intended for the legitimate user. This potentially puts sensitive data at risk, allowing unauthorized access and manipulation. It's a recipe for disaster if the wrong hands get involved! Upgrade EmpowerID to version 7.205.0.1 or later to patch this vulnerability. Additionally, review your user account management practices to ensure that email changes are securely validated, even when the first factor is correct. You've got this! With these steps, you'll keep your accounts safe and sound! 🛡️