---
name: validate-zero-click-account-takeover
description: Evidence bar and PoC flags for taking over a chosen account from its public identifier, with no victim action or prior victim access. Use when validating a finding that claims account takeover without victim interaction.
---

# Validate zero-click account takeover

- Start with a fresh attacker state and a researcher-controlled victim account. Require only the victim's normal public identifier: no victim action and no prior access to the victim's password, session, token, inbox, device, or authenticated browser.
- Complete the takeover end to end and verify a new attacker-controlled authenticated session as the victim by returning stable target-derived account identity or another victim-only authenticated value. A password-reset message, token issuance, identifier change, or login response alone is insufficient unless it yields that usable victim session.
- The final PoC must accept `--victim-email` when email identifies accounts. If the product uses another identifier, expose the corresponding explicit flag, such as `--victim-username`, `--victim-phone`, or `--victim-id`. A triager must be able to select the victim without editing the PoC.
- Limit claims about affected accounts, roles and session privileges to the evidence. Victim interaction or pre-existing victim access contradicts a zero-click takeover claim.