Log into MyAccount from the new user

Oct 13, 2025 by wbrum.org 69 views

Introduction

In this article, we will discuss an issue with the MyAccount feature in a specific version of the software, where it uses an invalid Authorization header to change the password. This results in a 401 response, instead of successfully updating the password. We will go through the steps to reproduce this issue and provide the necessary information to help resolve it.

Description

When trying to reset the password from MyAccount, the software uses the username:password in the Authorization header of the following request:

curl --location --request PATCH 'https://localhost:9443/t/carbon.super/scim2/Me' \
--header 'Accept: application/json, text/plain, */*' \
--header 'Authorization: Basic ****************************' \
--header 'Connection: keep-alive' \
--header 'Content-Type: application/json' \
--data-raw '{
    "Operations": [
        {
            "op": "add",
            "value": {
                "password": "Test@123456"
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}'

The password in the Authorization header is the new user password. This is incorrect, as the token should have been used to make the API call. Instead, the software is using the new user password as the Authorization header, which results in a 401 response.

Steps to Reproduce

To reproduce this issue, follow these steps:

Create a new user: Create a new user in the system.
Log into MyAccount from the new user: Log into MyAccount using the new user credentials.
Go to 'Security' section and try to change the password: Go to the 'Security' section and try to change the password.

Version

The version of the software that exhibits this issue is 7.0.

Environment Details (with versions)

The environment details are not provided in the given information.

Impact

This issue has a significant impact on the functionality of the MyAccount feature. It prevents users from successfully changing their passwords, which is a critical security feature.

Solution

To resolve this issue, the software should be modified to use the token to make the API call, instead of using the new user password as the Authorization header. This will ensure that the password change is successful and the user can log in with their new password.

Recommendations

To prevent similar issues in the future, it is recommended to:

Use tokens for API calls: Always use tokens to make API calls, instead of using passwords or other sensitive information.
Validate Authorization headers: Validate the Authorization headers to ensure that they are correct and not using sensitive information.
Test security features: Thoroughly test security features, such as password change, to ensure that they are working correctly.

Conclusion

Introduction

In our previous article, we discussed an issue with the MyAccount feature in a specific version of the software, where it uses an invalid Authorization header to change the password. This results in a 401 response, instead of successfully updating the password. In this article, we will provide a Q&A section to help answer some of the common questions related to this issue.

Q: What is the cause of this issue?

A: The cause of this issue is that the software is using the new user password as the Authorization header, instead of using the token to make the API call.

Q: Why is this a security risk?

A: This is a security risk because it allows an attacker to gain access to the system by using the new user password as the Authorization header. This can lead to unauthorized access to sensitive information and potentially compromise the security of the system.

Q: How can I reproduce this issue?

A: To reproduce this issue, follow these steps:

Create a new user.
Log into MyAccount using the new user credentials.
Go to the 'Security' section and try to change the password.

Q: What is the impact of this issue?

A: The impact of this issue is that it prevents users from successfully changing their passwords, which is a critical security feature.

Q: How can I resolve this issue?

A: To resolve this issue, the software should be modified to use the token to make the API call, instead of using the new user password as the Authorization header.

Q: What are some best practices to prevent similar issues in the future?

A: Some best practices to prevent similar issues in the future include:

Using tokens for API calls, instead of using passwords or other sensitive information.
Validating Authorization headers to ensure that they are correct and not using sensitive information.
Thoroughly testing security features, such as password change, to ensure that they are working correctly.

Q: What is the recommended solution for this issue?

A: The recommended solution for this issue is to modify the software to use the token to make the API call, instead of using the new user password as the Authorization header.

Q: Can this issue be fixed by simply updating the software?

A: No, this issue cannot be fixed by simply updating the software. The software needs to be modified to use the token to make the API call, instead of using the new user password as the Authorization header.

Q: What are some potential consequences of not resolving this issue?

A: Some potential consequences of not resolving this issue include:

Unauthorized access to sensitive information.
Compromise of the security of the system.
Loss of user trust and confidence in the system.

Conclusion

In conclusion, the MyAccount feature in version 7.0 of the software uses an invalid Authorization header to change the password, resulting in a 401 response. This issue can be resolved by modifying the software to use the token to make the API call. It is essential to use tokens for API calls, validate Authorization headers, and thoroughly test security features to prevent similar issues in the future.