https://moza369.github.io/tags/token/Recent content in Token on MOZAHugoen-usSat, 07 Jun 2025 00:00:00 +0000https://moza369.github.io/writeups/token-invalidation-account-deletion/Sat, 07 Jun 2025 00:00:00 +0000https://moza369.github.io/writeups/token-invalidation-account-deletion/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Roblox</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Improper Authentication</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Low (adjusted by vendor)</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>I was reading through HackerOne reports when I came across one about testing whether platform functions still work after you delete your account. Simple concept, but nobody was testing it.</p> <p>So I tried it on a community platform.</p> <p>I created an account, set up a server, and used Burp Suite to capture a <code>PATCH /v4/communities/{id}</code> request. Then I deleted my account via <code>DELETE /v4/users/@me</code>, waited some time, and replayed the saved PATCH request.</p>