What Is Nykaa Fashion?
Nykaa Fashion, A one stop shop for designer wear that is specially curated to cater to the needs of modern Indian women.
What Is The Flaw?
One of their Internal API can log you into any Nykaa Fashion account bypassing your Email Address into the request, and in response, it returns with the Access Token.
Access Token can be used to access your Nykaa Fashion account.
Why Is It Big?
Nykaa Fashion has a user base of approximately a million users.
And These Users are at risk of getting their information leaked on the web.
Hackers and Telemarketers can mine the data of Nykaa Fashion by automating a script using a phone number dump found online.
How Do I Reproduce The Flaw?
–I have created an automated script for demonstrating the flaw, It will auto-generate the Access Token for your Email Address and log you into your Nykaa Fashion Account, and show your account information, like Email, Address, Phone Number and Order List.
For our test, we are going to use disposable Email Addresses from mailsac.com
Your data will be displayed below.....
==============================
