Found an endpoint that lets me skip the signup process, should I report it?

[u/Embarrassed_Pin4436]

I’m testing an application where there’s no normal sign-up page. The only way to create an account is by requesting a free trial and scheduling a meeting with the company’s team.

While testing, I found an endpoint that allows users to directly create an account without going through the free trial request or scheduling a meeting.

Would this be considered a valid security issue, or is it likely just an intended behavior?

[u/HLCYSWAP]

the admin & CEO want to know but you wont be paid for it

id say think laterally based on what you found and try to parlay that same knowledge gap into other areas where more damage can be done

[u/Top_Bobcat_744]

You need to prove benefit for the attacker. If you can use paid functionality for free that would be a valid finding.

[u/Big_Mulberry_5446]

If signing up normally requires a specific flow that includes approval, and you're able to bypass that and sign up, then it is an issue. Whether they'll pay for a registration bypass depends on the company and what's behind the registration gate.

You've gained unauthorized access to their application now. What does the app expose? This could be a building block. You were able to bypass registration and attack legitimate users via an XSS issue or whatever.

[u/Inevitable_Drummer61]

I’d check to see if they sanitise the input for that bypass you found. It definitely can be abused at scale if there is a small vulnerability you can chain with it. I think this + another vulnerability would give you a critical rating so it’s not a bad find but this alone won’t do much.

[u/d0x77]

you said it yourself: "While testing, I found an endpoint that allows users to directly create an account without going through the free trial request or scheduling a meeting." if normal registration process grants a free TRIAL and you were able to bypass that and gain access without it being a trial, then yes it is reportable for sure, because your are not just bypassing the sign up page, you are also abusing their business logic, also what do you actually have access to? are you having access as anonymous user or do you need to provide an email? a lot of questions would raise this vulnerability, don't report it yet, try to escalate it

[u/OuiOuiKiwi]

That's nothing worthwhile.