Unreleased function leads to 150$ bounty

Hi ,

The story begin in the past , this was my first bounty in the bug hunting field, and in my luck , it was in a public BBP in hackerone .

The target is a paying platform , its for making paying links , while i was hunting i saw a request with a name “/enforce_mfa” , i didn’t what it is for in the begining , but after i changed the parameter in response body from false to true , I realised that this request is for a function that makes you must make a 2fa to open your account , so i reported it as a “enforce mfa bypass” , after two weeks i opened the application one time and see a team function that you can enforce the invited users to set 2fa to have access for the account!

Steps to produce:

Learned Lessons:

Don’t only change from true to false , you can also change from false to true , you may find an unreleased functionality.