# Hidden Field Manipulation

## How We Found It
On the sign-in page, there is a I forgot my password. This page contains just a submit button.
when I open the html of the page, there is a hidden field, this hidden field contains an email.
when we change the email and click submit, we get a flag.

## Utility of It
- Lets an attacker change internal data (like an email) sent to the server.
- Can lead to unauthorized access, data leaks, or in this case, retrieving a flag.
- Highlights trust in client-side values, which should never be trusted.

## How Can We Patch It
- Never rely on hidden fields for sensitive logic (e.g., user identity, permissions).
- Always validate input server-side against the authenticated user/session.
- Use server-side state instead of hidden form values when possible.
- If form fields must be used, consider signing or encrypting them (with care).