18/07/2026
🚨 Email Change Takeover Bug: When Changing Email Becomes Account Takeover
Email address is one of the most important parts of any online account.
It is used for login, password reset, security alerts, OTPs, invoices, notifications, and account recovery.
But if the email change process is weak, attackers may abuse it to take over user accounts.
This is called Email Change Takeover Bug.
🔍 What Is Email Change Takeover?
Email change takeover happens when an attacker can change the email address linked to an account without strong verification.
If the system does not properly verify the old email, new email, password, session, or MFA, the attacker may replace the victim’s email with their own.
After that, they can reset the password, receive security alerts, and control the account.
⚠️ Common Email Change Bugs:
🔹 Email changed without password confirmation
🔹 Email changed without verifying old email
🔹 Email changed without verifying new email
🔹 Verification link works multiple times
🔹 Old session remains active after email change
🔹 Password reset goes to attacker’s new email
🔹 MFA not required for email change
🔹 Email change allowed from hijacked session
🔹 Weak CSRF protection on email update
🔹 API accepts modified user ID or email field
🔹 Email change token does not expire
🔹 User not alerted after email update
🎯 Why This Is Dangerous:
🔹 Full account takeover can happen
🔹 Password reset can be redirected
🔹 Security alerts go to attacker
🔹 Victim may lose recovery access
🔹 Business accounts can be compromised
🔹 Sensitive data can be exposed
🔹 Attacker can lock out the real user
🔹 Trust and platform security can be damaged
🧠 Example Scenario:
An attacker gains access to a victim’s logged-in session.
They go to account settings and change the email address.
The platform only asks for the new email and does not require password, MFA, or old email confirmation.
Now the attacker controls the recovery email.
They can request a password reset and take full control of the account.
This is how weak email change logic can become account takeover.
🛡️ How Companies Can Stay Safe:
✅ Require password confirmation before email change
✅ Require MFA for sensitive account changes
✅ Verify the new email before activating it
✅ Send security alert to the old email
✅ Delay sensitive changes for high-risk accounts
✅ Invalidate old sessions after email change
✅ Prevent email change from suspicious sessions
✅ Use short-lived verification tokens
✅ Make verification tokens single-use
✅ Log every email change event
✅ Alert users about email update attempts
✅ Rate limit email change requests
✅ Validate ownership on backend APIs
✅ Test email change flow during security reviews
🔥 Why Ethical Hackers Should Care:
Email change takeover is a serious authentication and account security vulnerability.
It may look like a simple profile update feature, but the impact can be critical.
Modern ethical hacking should test email update flow, old email verification, new email verification, password confirmation, MFA enforcement, token expiry, session handling, and password reset behavior.
An email address is not just contact information.
It is the recovery key to the account. 📧⚠️
If email change is weak, account takeover becomes easy.
