Severe security incident involving a logic flaw in the OpenMonero platform’s 2FA implementation. This vulnerability allowed unauthenticated attackers to compromise user accounts systematically.
Technical Explanation
The vulnerability existed within the API endpoint used to finalize 2FA authentication:
GET /api/user/login_2fa/?username=X&code=Y&verification_method=app
The server-side handler failed to validate the username and code parameters. Instead of verifying the provided credentials, the system automatically generated a valid session (JWT and refresh token) for the account with the lowest ID (the oldest account) in the database.By deleting or disabling the account they had just compromised, an attacker could force the system to return a session for the next oldest account upon the next request. This created a repeatable "walking" mechanism that allowed an attacker to sequentially hijack every account on the platform.
Account Takeovers (ATO): Unrestricted access to user accounts.
Financial Loss: Direct theft of funds from user wallets.
Data Breach: Unauthorized access to over 30,000 user records.
Privacy Exposure: Exposure of sensitive personal information, including private trade chats and physical shipping addresses.
