🎯 New Report #3378540: Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
🔺Severity: Low
👽 Reporter: theokeen
⭐️ Reputation: 13878
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: null
🕐 Submitted: 2025-10-10
⏰ Disclosed: 2026-03-18 12:47:07
📝 Summary: A vulnerability was discovered in the reward redemption process of a points and rewards system. The vulnerability allowed an attacker to obtain multiple valid Burp Suite Pro licenses by using different email addresses, without any validation or verification tied to the user's account. The email contained a link to redeem the reward, which directed the user to a Google Form. After submitting the form with different email addresses, the attacker received multiple valid licenses. The lack of proper identity verification before issuing the license, and the absence of rate limiting or CAPTCHA, enabled the abuse of the reward system.
📂 Report JSON File: 3378540
@hackeronereports