Collected research
The PayPal 2FA Bypass
The PayPal 2FA Bypass: How Legacy Infrastructure Impacts Modern Security
PayPal's servers issued fully authenticated session tokens once a username and password were accepted, before the second factor was checked, and the mobile app enforced the logout only on the client. Switching the phone to airplane mode at the right instant stopped that logout and gave complete account access without the security key.
Record
- Document
- The PayPal 2FA Bypass: How Legacy Infrastructure Impacts Modern Security
- Researcher
- Jon Oberheide
- Published by
- The Duo Security Bulletin
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Jon Oberheide, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .