> For the complete documentation index, see [llms.txt](https://sec88.0x88.online/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sec88.0x88.online/web-appsec/features-abuse/email-change.md).
# Email Change
Domain-Based Authorization Hijacking
> Identify critical features linked to a user's email domain. For instance, consider a target app that grants access to resources based on your email domain. Some apps let you join a team or workspace directly if your email matches the team's domain (e.g., join Victim SITE XYZ only with sample\@victimsitexyz\[.]com). Others restrict access to documents or videos based on email domain whitelisting. Numerous such opportunities exist where email plays a crucial role.
[Unlocking Important Resources with Email Verification Bypass](https://x.com/Jayesh25/status/1725429962931335599)
1. Log in to your attacker account and change your email address to an attacker-controlled email (e.g., ).
2. You'll likely receive an email confirmation link on your attacker-controlled email (Do not verify it yet).
* Now, change your email to the unregistered email or domain you wish to HIJACK (e.g., ).
* This action will send an email verification link to , which you don't have access to.
* Try clicking on the "Email" verification link sent earlier to . If the system fails to revoke the previous email verification link,
* the link for could end up verifying the email for , allowing you to claim it as verified.
1. Once you've claimed an email associated with another organization's domain, identify the associated functions to prove impact and report it to earn some generous bounties
Improper Integrity Leads to ATO
{% embed url="" %}
1. An attacker links `attacker@website.com` to their account.
2. An attacker sends a email-change confirmation link to a victim.
3. A victim follows the link from an email while logged into an application.
4. An application links `attacker@website.com` to a victim.
Improper Session Validation
* [ ] [Insufficient Session Expiration - Previously issued email change tokens do not expire upon issuing a new email change token](https://hackerone.com/reports/1006677)
* [ ] [user changes mail to attacker@gmail.com -> user realizes that he mistyped the mail -> so he again changes to mail he owns and verifies it -> old link sent to attacker@gmail.com is still active even after new mail has been verified](https://cysky0x1.medium.com/full-account-takeover-due-to-oauth-misconfiguration-50d8747b268e)
Misconfiguration Between Email Change and Registration Features
1. Request to change the email to `test@x.y`
2. You will receive a confirmation link
3. Don't confirm and go register account
4. Then use email changing confirmation link
ATO by changing the email to existing account
* [ ] IDN Homograph Attack
* [ ] Bypassing “email already exists” error By `NULL Byte Attack` and `Special Characters %20` at the end `your@email.com%20`
Email-Change Confirmation Workflow and OAUTH misconfiguration
1. Go to account settings and change mail address to
2. Link will be sent to , now the user realizes that he have lost access to due to some reasons
3. Change mail to the another mail address for e.g which he owns and has access to
4. Even after verifying , the old link which was sent to is active, so user/attacker having access to that mail can verify it and Observe the OAuth misconfiguration that leads to account takeover
XSS/HTML Injection
* [ ] Test XSS in email Section
* [ ] Test Html Injection Reflected in Victim EMail after changing your email to his email
Lack of password confirmation when email change
* [ ] [No Password Verification on Changing Email Address Cause ATO](https://hackerone.com/reports/292673)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://sec88.0x88.online/web-appsec/features-abuse/email-change.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.