✓ Vulnerability reportedairbnb

Muster found a full account takeover in Airbnb's HotelTonight infrastructure

The Muster engine identified a debug endpoint on HotelTonight's staging API that leaked password reset tokens in plaintext, enabling immediate, zero-interaction account takeover of any user, including access to PII and live authentication tokens.

ATO

Account takeover

User interaction needed

✓

Responsibly disclosed

The target

Airbnb acquired HotelTonight in 2019 to expand its last-minute booking capabilities. HotelTonight's API infrastructure continues to serve millions of users booking same-day hotel stays.

Like many acquisitions, legacy staging and test environments can persist alongside production systems. When those environments share real user data or authentication flows, they become high-value attack surface.

This vulnerability was identified through autonomous subdomain enumeration, API endpoint discovery, and authentication flow analysis, without manual researcher intervention.

Fully autonomous discovery

The vulnerability

CRITICALPassword reset token leak via debug endpoint

A debug endpoint on HotelTonight's staging API returned password reset tokens directly in the API response body. An attacker could request a reset for any email address, receive the token in plaintext, and immediately use it to set a new password, with no email inbox access required.

# Step 1: request password reset - token returned in the response
POST /v4/reset_password  { email: "victim@example.com" }
# -> response includes reset_token in plaintext

# Step 2: use the token to reset the password + receive a live session
PUT /v4/reset_password  { token: "...", password: "..." }
# -> response includes auth_token, email, phone, JWT

Full account takeover confirmed

The reset response returned a live auth_token plus PII (email, phone, JWT), granting immediate, full account access. Browser login was also confirmed functional post-reset. Zero user interaction required.

✓

Vulnerability reported to Airbnb Security

The finding was responsibly disclosed with full reproduction steps, confirmed account-takeover evidence, and remediation recommendations for the staging environment.

What this means

Staging and test environments are among the most overlooked attack surfaces in enterprise security. When acquired companies' legacy infrastructure persists with debug endpoints exposed, the results can be catastrophic: in this case, full account takeover with PII exfiltration requiring zero user interaction. Muster treats staging infrastructure with the same rigor as production.

“A debug endpoint leaking reset tokens is about as bad as it gets: two API calls to own any account. This is the type of finding that lives in the blind spot between acquisition integration and production security. Our system found it because it doesn't skip staging subdomains the way manual audits often do.”

NJNabeel JavedSecurity Researcher, Muster

Why Muster

✓Full attack surface coverage

Production, staging, test, and legacy environments are all in scope by default.

✓Authentication flow analysis

Autonomously tests password reset, login, and session management for logic flaws.

✓Acquisition blind spots

Discovers forgotten infrastructure from M&A that internal teams may not be monitoring.

✓Immediate actionability

Reports include full exploit chains with reproduction steps.

Know your full attack surface.

The same engine that found this can run against your app. First exploits in about 10 minutes, free.

Start free pen test →

reported April 2026 · findings via public bug-bounty programs · not affiliated with these companies