S1AV-2027-00431

Approved identity fixtures re-enroll repeatedly despite duplication control

Sanctioned test identities were able to complete enrollment repeatedly in the sandbox despite a control intended to prevent duplication.

S1AV-2027-004315.6MediumNeeds More InfoRestricted

Authorized testing only

  • Use only approved accounts, systems, and scenarios.
  • Do not interact with uninvolved people.
  • Do not cause real financial loss.
  • Do not access accounts without authorization.
  • Do not obtain or submit stolen credentials.
  • Do not harass, dox, threaten, or extort anyone.
  • Stop testing if you encounter real victim harm.

Weakness classification

S1WE-100

Identity & Enrollment

Identity proofing, onboarding, enrollment, uniqueness and verification controls.

SYNTHETIC_IDENTITY

Lifecycle

Day 0Submitted with reproduction package and proposed S1SS
Day 1Triaged by ScammerOne analyst, scope confirmed
Day 2Validated by sponsor in sandbox tenant
Day 4Bounty awarded at sponsor-defined band
Day 6Remediation ticket opened, retest scenario queued

Private evidence

Reproduction steps, sandbox account references and captures are restricted to the sponsor triage team. The public disclosure page omits them automatically.