Business Logic Flaw: Refund Limit Bypass via Support Chatbot

Target: [REDACTED] (audiobook/subscription service) Vulnerability Class: Business Logic Error / Improper Enforcement of Rate Limit Reported Component: Customer Support Chatbot ([REDACTED]/contactus)

Summary

[REDACTED] enforces a limit of 2 refund credits per account to prevent abuse of its self-service return/refund feature. This limit is enforced on the standard in-app/website return flow, but it is not enforced when refunds are processed through the customer support chatbot. As a result, a user who has already exhausted their 2 allotted refund credits can continue to return an unlimited number of purchased titles by initiating the refund through the chat support channel instead of the standard return flow, fully bypassing the intended limit without needing to contact a human customer service agent.

Vulnerability Details

[REDACTED] allows customers to self-serve refunds on digital titles (e.g., audiobooks) up to a cap of 2 refunds per account, presumably to prevent abuse where a user could purchase, "read"/listen to, and return titles indefinitely at no cost. This cap appears to be enforced correctly in the primary return flow (e.g., via account/order history).

However, this same restriction is not applied consistently to refunds issued via the support chatbot at [REDACTED]/contactus. Once a request to refund a title is submitted through the chatbot flow, the refund is processed even though the account has already exceeded its refund credit limit.

This indicates the refund-limit check is being enforced at the client/flow level (or only in one backend code path) rather than centrally at the account/order level across all refund-issuing channels.

Disclosure Notes

This writeup is based on a bug bounty report as submitted; some technical detail (chatbot transcripts, screenshots, exact backend behavior, timeline of triage/fix) was not included in the original submission and has been noted as such rather than fabricated.