writeups.xyz / Password reset code brute-force vulnerability in AWS Cognito

Submitter : c2a

Date: 30 April 2021

Bounty : undisclosed

Vulnerabilities :

• Password Reset
• Bruteforce
• Rate Limiting Bypass
• Account Takeover

Programs :

• AWS

Authors :

• Pentagrid (@Pentagridsec)

Link :
https://www.pentagrid.ch/de/blog/password-reset-code-brute-force-vulnerability-in-AWS-Cognito/