Verification or account merge preserves another actor's access
Registration, verification, email change, or federation merging transfers trust to an identity while retaining an unintended actor's usable credentials or session.
Candidate CWE: CWE-287
Test hypothesis#
In the replica, create an unverified password account for an owned test inbox in profile A. Complete the legitimate verified/federated signup for that inbox in profile B. Check whether A's prior password/session remains usable against the now-verified private account. Test a stale email-verification link after a second owned email change separately.
Evidence required#
Before/after internal account IDs, verification state, linked issuer/subject, origin of the retained credential, and controlled private access after the transition.
Rule out false positives#
Aliases intentionally identifying one account, explicit authenticated linking, a duplicate-registration error, or an unverified account that gains no new protected access is not account takeover.
Playbook and command references#
- Authentication, recovery, federation, and session lifecycle — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- OAuth, OIDC, and SAML: transaction binding and token trust — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.