Redde Online — Security Assessment
5
Critical
12
High
14
Medium
10
Low / Info
41
Total
Critical Findings Summary
VULN-38Plaintext Password TransmissionCRITICAL
Password reset emails the actual password in cleartext — confirming reversible password storage. Attacker with email access = immediate account takeover.
VULN-36Privilege Escalation via Account UpdateCRITICAL
PUT /users/{userid} allows any authenticated merchant to set iscustomer:false, changing their own account type to staff. Confirmed live.
VULN-37Account Verification Bypass (Self-Unlock)CRITICAL
Same PUT endpoint accepts islocked:false, bypassing email + phone verification entirely.
VULN-01Complete API Authentication BypassCRITICAL · CVSS 10.0
POST /v1/receive accepts payment collection requests with no API key. Any caller can initiate payment flows on behalf of any merchant.