🔥 Account Takeover via Duplicate Registration — A 1500 Euro Jackpot

The Bug

Found a critical account takeover in a web application’s registration flow.
The platform allowed creating the same account (same email) from a different session, even though the account already existed.

Step-by-Step PoC

1. Create account with email: xyz@account.com and place some orders.

2. In a different session, re-register using the same email: xyz@account.com.

3. ✅ Registration works again — no error for duplicate account.

4. Now the attacker controls:

   • The victim’s orders

   • Can change the password

   • Full account access = Total takeover.

Impact

• Complete account takeover

• Orders, personal data, everything exposed

• Victim locked out after attacker changes password

Status

• Accepted as High ✅

• Rewarded 1500 Euros 💰

---

Takeaway

Duplicate account creation = critical bug hiding in plain sight.
Sometimes basic checks (like preventing duplicate registrations) protect the entire platform.