Account takeover (ATO)

When it applies

Any flow that can grant control of another user's account: password reset, email change, session issuance, social/SSO linking, OTP/2FA. ATO is the highest-value web finding — hunt it deliberately.

Why it works

Auth flows have many moving parts (tokens, emails, sessions, second factors); a single weak link — a predictable reset token, a host-header-controlled reset link, an email change without re-auth, an OTP with no rate limit — hands over the account.