Hilton Honors Flaw Exposed All Accounts
Summary: Security consultants Brandon Potter and JB Snyder found that anyone logged into a Hilton Honors account could hijack any other account by knowing or guessing its valid 9-digit account number, with only a small change to the site's HTML and a page reload. The flaw exposed email addresses, physical addresses and the last four digits of credit cards on file, and let attackers change passwords, view travel history, redeem points or send points as cash to prepaid cards; Hilton says it fixed the issue after KrebsOnSecurity notified it.
What's compelling: A 9-digit account number was the only thing standing between an attacker and a customer's points balance, travel history and partial card data, and the site's PIN reset page would confirm whether any 9-digit number was valid, making enumeration automatable.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026