Account Takeover in Fastmail
Bug Bounty
Fastmail's password-reset flow skipped OTP verification whenever a request's User-Agent matched the one recorded at signup, a header the client fully controls, making it trivial to impersonate a 'trusted device' and take over any account.
