CoinDepo Disclosed Report

Hy Team Have Good Day

Summary

Critical IDOR vulnerability in /api/get_user_loan allows accessing any user's loan data by simply changing the username parameter to victim's email.

Impact

• Access any user's USDT loan information
• View sensitive financial data of other users
• User enumeration via email addresses

Root Cause

No authorization check that authenticated user matches requested username parameter.

Fix

if (authenticated_user !== request.username) {
    return 403;
}

Vulnerable Request:

POST /api/get_user_loan HTTP/2
Host: app.coindepo.com

[email protected]  ← Any user's email
amount=54654
coin_id=2

Test Results:

• Attacker email: [email protected]
• Victim email: [email protected]
• Same response for both = IDOR confirmed