BugForge - Daily - Copy Pasta (Repeat)

Daily - Copy Pasta (Repeat)

This is a repeat of the daily challenge from January 21st, 2026.

---

Vulnerability Overview

The Copy Pasta application contains a Broken Access Control vulnerability in the form of an Insecure Direct Object Reference (IDOR) on the password reset endpoint. The endpoint accepts a userId parameter without verifying that the authenticated user is authorized to act on that account, allowing an attacker to reset passwords for arbitrary users, including administrators. Public API responses further leak usernames, making it trivial to identify high-value targets. By chaining identifier manipulation with information disclosure, an attacker can achieve full account takeover and access sensitive application data.

Key Issues:

• The password reset endpoint trusts client-supplied userId without server-side authorization checks
• Public API responses expose internal identifiers and usernames
• No additional verification (such as OTP or existing password confirmation) is required for password resets

---

Vulnerabilities Covered

• Broken Access Control
• Insecure Direct Object Reference (IDOR)

---

Classification

• OWASP Top 10: A01:2021 - Broken Access Control
• Vulnerability Type: Insecure Direct Object Reference (IDOR)
• Attack Surface: User profile and password reset endpoints
• CWE: CWE-639 - Authorization Bypass Through User-Controlled Key

---