🫏Subscription Enforcement Bypass Leading to Unauthorized Full Application Access

Here we go ^_^

Target Overview

The target application uses a subscription-based model where users must have an active trial or paid plan to access the app.

Once a subscription expires, access to those features should be blocked until the user renews their plan.

While testing the application, I discovered a business logic issue that allowed expired users to continue using premium functionality without purchasing a subscription.

Have a plan → you can use the web app Plan expired → you can't use any feature or function in the web app

How I Found It

During testing, I was reviewing how the application handled expired subscriptions.

When attempting to access premium functionality using an expired account, the application correctly displayed a message indicating that the subscription had expired.

At first, everything looked normal.

However, after clicking with the restricted feature several times, I noticed that the application eventually allowed access even though the account was still expired.

This behavior seemed unusual, so I started testing other premium features and found that the same issue existed in the whole application.

Proof of Concept

1. Log in using an account with an expired trial or subscription.
2. Attempt to access the features and observe that the application displays a message indicating that the trial or subscription has expired.

3. Continue clicking or interacting with the restricted functionality multiple times.

4. Observe that the application eventually grants access despite the account having no active subscription.

5. Repeat the same behavior on additional premium or restricted functionalities.

6. Observe that the same bypass occurs across multiple areas of the application.

Result

The user gains unauthorized access to premium functionality without renewing or purchasing a subscription.

Impact

This issue allows users with expired subscriptions to continue accessing features that should only be available to paying customers.

Takeaway

No tools, no need for open burp … only open browser and click multiple times to be a premium user :)

Report Status

Let's Connect: x account || linkedin || facebook [new account]

"سُبْحَانَكَ اللَّهُمَّ وَبِحَمْدِكَ ، أَشْهَدُ أَنْ لا إِلَهَ إِلا أَنْتَ ، أَسْتَغْفِرُكَ وَأَتُوبُ إِلَيْكَ"