---
id: 6580
title: "Permanent account takeover on Yahoo's Small Business platform"
source_domain: samcurry.net
source_url: "https://samcurry.net/permanent-account-takeover-on-yahoo-small-business"
published_at: "2017-06-25T00:00:00Z"
tags: ["bug-bounty", "account-takeover", "authentication", "password-reset", "yahoo", "token", "security-news", "samcurry-net"]
phying_url: "https://phying.com/item/6580"
lang: en
---

# Permanent account takeover on Yahoo's Small Business platform

## Summary

The password-reset flow on Yahoo's small business platform carried a client-controlled 'uuid'; a signature/user-ID mismatch let attackers permanently take over other users' accounts.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2017-06-25T00:00:00Z
- **Original:** https://samcurry.net/permanent-account-takeover-on-yahoo-small-business
- **Phying News:** https://phying.com/item/6580