PayPal's payment system is vulnerable to a flaw in its verification process, which could allow anyone to bypass the online service's filter or restriction and gain access to blocked accounts. The vulnerability is found in PayPal's mobile app, which does not check for blocked accounts from the central service.
On a desktop or laptop, when the user enters an incorrect "username" or "password" multiple times, then for security reasons PayPal will block that account until the user answers several recovery and confirmation questions.
However, if the specific user tries to log into their temporarily blocked PayPal account, with the correct credentials, from an official mobile app, then they will gain access to the specific account.
“The application only checks whether the account exists and not whether it is partially or fully blocked. It is very likely that the blocked user has access to their account, can send money and make any transaction from there,” as written in the company's report on the application's vulnerability.
This significant security flaw was discovered a year ago by Benjamin Kunz Mejri, and as the lead researcher, he immediately reported his findings to PayPal, but not only has the problem not been fixed, but Benjamin himself has not been paid for his discovery. Although the vulnerability was given a severity rating of 6.2, it has not yet been given an identifying designation.
Benjamin Kunz Mejri even posted a video of himself repeatedly entering incorrect login information, causing his PayPal account to be blocked. After this is done, the system asks him to answer a few security questions in order to restore the account.
At that moment, however, using his iOS device, he logs in, entering the correct username and password combination, and gains access to his previously blocked account.
This security flaw affects the app on iOS – both iPhone and iPad – as it cannot check security mechanisms that would not allow access on a computer. According to Benjamin's report, iOS versions 4.6.0 and 5.8 have this problem.
The service offered by PayPal as a subsidiary of eBay serves over 148 million accounts in 26 different currencies and 193 global markets, while handling approximately 9 million payments daily.
