Critical Vulnerability That can be Exploited to get people's accounts Terminated

Bug Reports Roblox Application and Website Bugs
,
1

Visual Aids:

image
image979×356 26.9 KB

Direct Links:

Brief Description:
Using the support system for Roblox, allows you to enter anybody’s email. Let’s use a YouTuber for example, let’s say you really don’t like them. If they have their business email publicly available, and is linked on their YouTube channel, and is linked to their Roblox account, ANYBODY could use their email, make a ticket for Roblox support sending a threat, and get them banned.

Here’s an example:
Let’s say this is KreekCraft’s email:
iamkreek@gmail.com
Let’s assume it was listed under his channel as his business email, and linked to his Roblox account.
If I go to Roblox Support, I can enter in his email, and since we all know his username, enter in the username, as shown below…

image
image1012×525 37.2 KB

You might be thinking, what is the problem with this?
If you send a threatening message, or anything that violates Roblox’s Terms of Service, your account gets banned. So you could get anybody banned.

Expected behavior

Expected Outcome:

Some sort of confirmation email sent from Roblox to confirm it was actually ME who created the ticket.
Below is some concept art of what it could look like…

image
image1572×1013 74.4 KB

Actual Outcome:

A ticket gets created, and people can put threatening messages in the support ticket details, or anything that violates ToS to get accounts banned.

An issue that made me create this post is in the following video where someone did EXACTLY what was listed above.

22 Likes
2

Yeah, this makes way too much sense — it would not only prevent abuse but also confirm that the real owner of the email is actually the one reaching out. It would instantly block a whole class of exploits. The fact that this kind of basic verification doesn’t exist is honestly crazy.

There’s even a YouTuber who had the FBI show up at his house because of this situation. People use the support system to send threatening messages to Roblox using that person’s email, and things can escalate to a really serious level:

Also, I feel like maybe they don’t want to enforce this. Like, if someone is currently logged into their account and using the email that’s already verified and connected to it, maybe Roblox thinks there’s no need to verify if it’s actually them when they contact support. But for literally every other imaginable scenario, this kind of verification seems absolutely necessary.

11 Likes
3

I noticed that some agents do realize that the ticket is unusual and ask you to confirm that you wrote it.
However some agents do take it as 100% real.
Here’s an example of an agent that noticed.

image
image794×580 30.4 KB

14 Likes
4

That should be something that they do by default. I honestly don’t know why they don’t do it.

11 Likes
5

Kreekcraft said that he was talking to Roblox about this issue a few days ago, so I assume they’ve been made aware.

7 Likes
6

I actually also know the FBI youtuber story you mentioned and it’s not the only one I think

4 Likes
8

I am noticing the same issue. I checked on 5/14/2025 (as I’m writing this), and the security loop hole is still there, the YouTuber who informed most of us about this situation only posted the video three days ago (I won’t name the YouTuber to avoid potential issues with directing users off-platform). Still, I believe this should be prioritized.

A simple two-factor authentication system (email verification code or backup code) could largely solve this problem. And if Roblox already has 2FA available in user settings, why hasn’t it been implemented here? If the concern is about making report forms accessible to kids—well, even kids know how to ask their parents to check a verification code in their email. Not to mention, every Roblox account already has an email linked.

2 Likes
9

In the unlikely event that Roblox sees this, implementing a safe environment for users will encourage consumers to spend money in-game. No one wants to buy gamepasses if their accounts can be disabled with zero effort. Patching this problem won’t take much effort on your part and will increase both your reputation and revenue. Improving the security of the report and support systems is the right step — we all agree.

2 Likes
10

Not really a vulnerability its more of just abusing a system that has not been thought of too clearly in terms of verifying that the submitter of the ticket is actually who they say they are.

This can easily be fixed by them just adding a SIMPLE check:

Create ticket → sent smtp to email to verify that they are the submitter via url → create ticket if confirmed otherwise once expired after 10 minutes don’t create the ticket.

Also this would require some kind of osint gathering or data retrieval to even get close to doing this as this requires your email.

1 Like
11

It can be considered a vulnerability now, because they are aware of how the system can be abused and haven’t fixed it yet.

2 Likes
12

I still wouldn’t call it a CVE. It is not that bad to be considered that.

This is just human error and also basic info gathering/osint gathering off the target which is then used against them by relying on the probability that the human on the other side of the ticket (aka the support tech) doesn’t just blindly think that the unusual activity from said email and ticket is you.

As shown before it can happen that some support techs actually realise this might not be you and then contacts you to confirm which then defeats the whole “CVE”.

Again not a CVE its just abusing the human factor that we are all animals and we all think differently.

1 Like
13

Hi, JamesAntlers here.

Funny enough, I don’t think this was fully fixed, I’ve been in light contact with the people that actually harassed me and caused the whole ordeal shown in that video, and supposedly they ran a test half a year or so ago and were able to get an alternative account banned with the same method they used to term me.

Roblox SOMETIMES sends Emails telling you that they got an “unusual” email from your address, but other times, they still believe you are the one that sent it and will punish you for it (or send the police to your house, in my case. how fun!) OR other times they’ll ask for confirmation if you sent it. It’s iffy though.

I’ll be checking this thread every once in a while, sorry it took me so long to get to it. It took like 6 goddamn hours of being on this stupid forum and having no mouth to scream at Roblox with when it comes to bad updates before I was able to send replies. I’ll be open to talking from here on out though.

3 Likes
14

That is absolutely absurd. It’s been 9 months, and they can’t even get security done right. If anything, what they claim they’re doing now is for safety, this would be more safe for users, since it wouldn’t put people at risk of the FBI showing up to their house.

2 Likes
15

Just letting you know, the FBI showed up because I had to file for them to speak to me over the issues I was facing with the police, roblox falsely sending me bans, the harassment online, etc. The FBI might have come regardless because of what was going on had I not called them, but TLDR;

Police came against my will, FBI came because I had to call them. Things were sorted out between me and the police once we had finished speaking, but I still had to worry about Roblox’s incompetency towards the situation.

3 Likes