Spamming vulnerability with CC login system

Question

Hi there,

I'm trying to report an issue with the CC login system which enables someone to spam a users mobile with unsolicited texts as long as they know their email address that is used to login to creative cloud and the user has 2 factor authentication enabled.

You can test this yourself if you have 2 factor enabled on your CC account.

1. Go to adobe home page (make sure you are not already signed in

2. Click sign in

3. Enter your email address

4. Click 'continue'

5. A notification is displayed saying that an sms has been sent to the users mobile and the code is required to continue

6. Press back in browser

7. Click 'continue' button again

8. Another sms sent

9. Repeat back and contine indefinitely.

There is a reason that the password is supposed to be requested before an SMS 2 factor code, and this is it. Maybe someone from Adobe that understands this process can explain why it is this way round and if they are aware of this issue.

tldr: Login page can be used to spam a users mobile phone with sms messages if you know their adobe cc login, and they have 2 factor enabled on their account.

Many thanks.

(btw I had to select random topics as it didn't have anything suitable, my bad)

Nancy OShea · Answer

Sharing Creative Cloud accounts with other users is a violation of Adobe's terms of service agreement.

I suggest you change your password now for security reasons and to prevent unauthorized access to your account. Log-in below to change your password.

https://account.adobe.com/security

Without the correct password, other users cannot access your account. Two-factor authentication is simply another layer of protection.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded