Mod Moved Comments To Chat
4 added 61 characters in body
source | link

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with luksa@mail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab (or a browser with cleared cache & cookies) -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added new test cases; thanks Zymus and, simbabque and Micheal Johnson for the suggestions

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with luksa@mail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added new test cases; thanks Zymus and simbabque for the suggestions

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with luksa@mail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab (or a browser with cleared cache & cookies) -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added new test cases; thanks Zymus, simbabque and Micheal Johnson for the suggestions

3 added a line to answer @simbabque's question
source | link

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with luksa@mail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added a new test case (luksa@gmail.com) -cases; thanks Zymus and simbabque for the suggestionsuggestions

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added a new test case (luksa@gmail.com) - thanks Zymus for the suggestion

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with luksa@mail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added new test cases; thanks Zymus and simbabque for the suggestions

2 added 161 characters in body
source | link

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added a new test case (luksa@gmail.com) - thanks Zymus for the suggestion

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.

As you said, you saw this on facebook - so I tried these steps:

  • Login with lukas@gmail.com and real password -> works
  • Login with lukas@gmail.cmo and real password -> works, too (!)
  • Login with luksa@gmail.com and real password -> also works
  • Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
  • Login with lukas@gmail.cmo in a private tab -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.


Edit: Added a new test case (luksa@gmail.com) - thanks Zymus for the suggestion

1
source | link