Executive brief
DroneAware, a drone detection platform, was vulnerable to an account 'pre-hijacking' flaw on its centralized server. An attacker could register an account using a victim's email address and a password of their choosing before the victim ever signed up. When the real owner later joined the platform via Google SSO or email verification, the attacker's secret password became active, allowing the attacker to silently log into the victim's account and access their data without any notification.
Technical details
An account pre-hijacking vulnerability existed in the DroneAware server's registration and SSO flows. The root cause was that account activation (via email verification or Google SSO) implicitly enabled all authentication methods associated with the account, including passwords set by an attacker during a pre-registration phase. An attacker could register a target's email address with a known password; when the victim later 'activated' the account through normal usage, the attacker-controlled password became valid. The vulnerability was mitigated by clearing existing password rows when an unverified account is activated via Google SSO and by reducing the email verification token lifetime. The fix was applied server-side to droneaware.io.
Affected products
- fduflyer DroneAware Server < server-2026-05-20
Timeline
- 2025-05-20: patched: Server-side fix deployed to droneaware.io
- 2026-06-17: disclosed: CVE-2026-48117 published