@mr_asg discovered an improper access control issue in TaxJar. This could have allowed for account takeover using the email change functionality. The vulnerability was caused by not correctly validating whether or not the reset password token was connected to the user being reset and was resolved by relying on the user fetched from the reset password token itself instead of the account ID provided in the URL. I discovered an IDOR in the Accountant Access form in Taxjar. This could have allowed an attacker to take over any user's account. The vulnerability was caused by manipulating the user's number in the POST request to /accounts/<ACCOUNT_NUMBER> with adding the user's email parameter carrying the attacker's email in the payload data in the request, which causing changing the email in the account associated with the number that was manipulated . And by a Proof Of Concept Python script, I made a loop in which the account number and the attacker’s email were changed every time, which demonstrated the attacker’s ability to carry out the attack against a large number of accounts...