{"uuid": "c06a79a4-4285-4ed8-830f-b1acf667d122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2651", "type": "seen", "source": "https://t.me/hacking_Attack/69929", "content": "Exploit Collector\nBookwyrm 0.4.3 Authentication Bypass\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nBookwyrm versions 0.4.3 and below suffer from an authentication bypass vulnerability due to a lack of rate limiting on OTP checks.\n\nSHA-256 | 01182b49f5094c1c536e28a7cca127e1933e717f4d3a739892d462bc0afce375\n\nDownload\n# Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass\n# Date: 2022-08-4\n# Exploit Author: Akshay Ravi\n# Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm\n# Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3\n# Version: <=\n# Tested on: MacOS Monterey\n# CVE: CVE-2022-2651\n# Original Report Link: https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550/\n\nDescription: Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm v0.4.3 Due To Lack Of Ratelimit Protection\n\n# Steps to reproduce:\n\n1. Create a acount with victims email id\n2. When the account is created, its ask for email confirmation via validating OTP \nEndpoint: https://site/confirm-email\n3. Enter any random OTP and try to perfrom bruteforce attack and if otp matches, We can takeover that account\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:38.094788Z"}