10

I went to http://dev.stackexchange.com (I tried this out because I thought maybe there's a SE site for it, but it seems to redirect me to http://www.stackexchange.com) and logged in. I pressed the button that "sends SE information to this site" and I got logged in as... Blondie21?

Logged in as someone else

Edit

It seems to login random names (girlish names) for different people, and it seems to be a SE dev site.

Improve this question
33
  • 3
    What if. Just what if. You shouldn't be messing with dev stuff?
    – michaelb958--GoFundMonica
    Feb 20, 2014 at 2:56
  • @michaelb958 Is that what dev.stackexchange.com is? Dev stuff?
    – Cilan
    Feb 20, 2014 at 2:57
  • Seems most likely, given that dev.stackoverflow.com and dev.meta.stackoverflow.com are already proven to exist.
    – michaelb958--GoFundMonica
    Feb 20, 2014 at 2:58
  • Hah! That's pretty great. OpenID auth fails for me, but I didn't earnestly expect it to work anyway.
    – user206222
    Feb 20, 2014 at 3:00
  • 3
    Worked fine for me.
    – Aaron Bertrand Staff
    Feb 20, 2014 at 3:01
  • No issue with StackExchange account. Got normal account####.
    – Meta Andrew T.
    Feb 20, 2014 at 3:06
  • Logging in with Google account I just see my normal user name. What login steps are you taking?
    – Martin Smith
    Feb 20, 2014 at 3:08
  • @MartinSmith I'm going to dev.SE and logging in, the same thing happened to my friend
    – Cilan
    Feb 20, 2014 at 3:10
  • Are the inbox notifications displayed yours?
    – Martin Smith
    Feb 20, 2014 at 3:12
  • @MartinSmith No, not at all
    – Cilan
    Feb 20, 2014 at 3:13
  • 3
    I logged in with my gmail account and got logged in as pauldawg, apparently a real stack overflow user. When I followed a link in the inbox to stack overflow, however, I arrived at the page under my correct account.
    – Chris Travers
    Feb 20, 2014 at 3:16
  • 1
    Maybe for older accounts the database ids are the same for dev and live but they got out of synch at some point?
    – Martin Smith
    Feb 20, 2014 at 3:22
  • 3
    This question appears to be off-topic because it is about the implementation of accounts on Stack Exchange's internal dev test network of sites, not on the public sites that non-employees should be concerned with.
    – Jeremy
    Feb 20, 2014 at 3:45
  • 3
    @JeremyBanks Depends what the security implementations are really. Can this be used to post messages under another account or change credentials or read confidential information?
    – Martin Smith
    Feb 20, 2014 at 3:47
  • 1
    You should never expect dev tiers to work entirely as production sites do. ;) We're working on a fix.
    – Adam Lear StaffMod
    Feb 20, 2014 at 18:39

1 Answer 1

Reset to default
5

This is a known issue. I'd already reported this1 a couple of months ago.

In the past there was a more serious vulnerability where the same thing would happen on dev.SO. Which leaks the email address of the dummy user (actually a real user taken from the dump).

As far as I can tell, there is no PII leak here, though, the bug is pretty harmless in itself.

Though this bug can possibly be leveraged to get deeper access (that was reported too). Don't try.

1. By proxy of @Undo, because he had a private room with the devs

Improve this answer
2
  • Obviously it is probably fixed by now, but why tell someone not to try when it could help confirm a security problem with a clear fix?
    – Cilan
    Feb 2, 2016 at 4:42
  • @Doorhandle If you have found a vulnerability and reported it (and know that it will be fixed), don't try and use that vulnerability to escalate, it's bad faith. Especially when the escalation has also been reported.
    – Manishearth
    Feb 2, 2016 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .