Critical Flaws in Khan Academy Opened Door to Account Takeovers

guest · May 22, 2019

Critical Flaws in Khan Academy Opened Door to Account Takeovers
May 22, 2019
https://threatpost.com/critical-flaws-in-khan-academy-opened-door-to-account-takeovers/144973/

Two critical cross-site request forgery (CSRF) flaws in educational non-profit Khan Academy’s website may have affected some users by allowing account takeover.

Khan Academy, a non-profit learning organization, produces short lessons in the form of videos that can be accessed online. The two critical flaws, which were both resolved shortly after they were reported and were publicly disclosed last week, stemmed from a lack of CSRF tokens, which double-check account log-in requests to make sure they aren’t CSRF attacks.

One of the flaws could have allowed attackers to takeover accounts that were created using the Google or Facebook login option (two options that are available for quick sign-ins using existing Facebook or Google usernames and passwords).
The other flaw could have allowed a bad actor to take over any unconfirmed account on Khan Academy.
Click to expand...

Log in or Sign up

Critical Flaws in Khan Academy Opened Door to Account Takeovers

guest Guest

Log in or Sign up

Critical Flaws in Khan Academy Opened Door to Account Takeovers

guest Guest

Useful Searches