S1AV-2027-00431
Approved identity fixtures re-enroll repeatedly despite duplication control
Sanctioned test identities were able to complete enrollment repeatedly in the sandbox despite a control intended to prevent duplication.
S1AV-2027-004315.6MediumNeeds More InfoRestricted
Authorized testing only
- —Use only approved accounts, systems, and scenarios.
- —Do not interact with uninvolved people.
- —Do not cause real financial loss.
- —Do not access accounts without authorization.
- —Do not obtain or submit stolen credentials.
- —Do not harass, dox, threaten, or extort anyone.
- —Stop testing if you encounter real victim harm.
Weakness classification
S1WE-100
Identity & Enrollment
Identity proofing, onboarding, enrollment, uniqueness and verification controls.
SYNTHETIC_IDENTITY
Lifecycle
Day 0Submitted with reproduction package and proposed S1SS
Day 1Triaged by ScammerOne analyst, scope confirmed
Day 2Validated by sponsor in sandbox tenant
Day 4Bounty awarded at sponsor-defined band
Day 6Remediation ticket opened, retest scenario queued
Private evidence
Reproduction steps, sandbox account references and captures are restricted to the sponsor triage team. The public disclosure page omits them automatically.