A test page, a welcome email, and a changed password

When I tried the correct password on my trial account, it still wouldn't let me in. That result meant I needed to withdraw part of the report I had already sent.

My initial report, submitted on March 26, 2026, covered three things: what appeared to be missing login throttling, a username-availability check, and reflected script injection on a test page. The login responses had led me to believe repeated attempts were getting through.

On April 13, the vendor explained that an account locks after five invalid attempts. I went back to my own trial account and tested that behavior. Once it was locked, even the correct password was rejected.

The lockout was working. I had put too much weight on the HTTP 200 responses. A server returning a page successfully says very little about whether it accepted a login attempt. I withdrew the throttling claim.

The vendor also explained that the username-availability check was intentional and subject to network-level rate limiting. That left the test page, where I had already demonstrated that supplied script could execute. The vendor described that page as unused and unlinked.

My separate April 17 report examined what that script could do inside an authenticated session.

The page wasn't linked from the normal interface. But code running there still ran under the application's origin. Being outside the usual navigation didn't separate it from the account functions available to a signed-in user.

The original screenshot showed an alert. It established that the script ran, but it didn't show what happened when that script interacted with the rest of the application.

I used my own account to examine two actions: changing the account's email address and sending a welcome letter. The second action turned out to matter because it regenerated the account password and sent the credentials by email.

There was a check on the email-change action that relied on the request's Referer. Script executing through the test page could make a same-origin request that satisfied that check. The request came from an application page, but that didn't establish that the account holder had deliberately authorized the change.

I changed my account's email address to another mailbox I controlled. Then I triggered the welcome-letter action.

The application regenerated the password and sent the credentials to the replacement address. My report records the final checks: the previous password stopped working, and I could log in using the new password.

That was the chain I submitted in the separate report on April 17.

The earlier lockout correction still stood. I hadn't found a way around the five-attempt limit. This sequence used the previously reported script injection to reach authenticated account actions, change where the email went, and invoke a feature that replaced the password.

The welcome letter connected those actions. Changing the email address determined the destination; regenerating the password put working credentials in the message sent there. Testing the actions together showed a consequence that the alert screenshot alone couldn't demonstrate.

I kept the testing within my own account and mailboxes. Afterward, I restored the account and deactivated the test employee records I had created. I didn't test the sequence against another person's account.

On May 4, the vendor assessed the issue as High severity. Its response placed the affected page in a limited test or development endpoint and said: "This page has now been removed, and the vulnerability was limited to that endpoint."

I didn't independently retest the removal, and the correspondence didn't establish whether the email-change or welcome-letter flows had received broader changes. The password replacement and successful login were observations from my original test; the remediation status came from the vendor's response.

There were also companion reports examining termination and suspension scenarios through the same foothold. On May 27, those were closed as ineligible for a new reward after the test page had been removed.