HiGame

Did you experience any unexpected activity on your Steam account last week? Well, it seems that there was a major security flaw in Valve’s password reset feature that allowed anyone to reset your password — even without access to your email. The accounts of numerous popular streamers were compromised for a short period, and Valve is left looking incredibly foolish.

If you forget your Steam password, Valve normally sends you a one-time-use code over email that you can use to reset your password. However, it was discovered last week that Steam wasn’t actually checking to verify that your code was valid. If you simply refrained from entering anything during the authentication step, the client would still allow you to reset the password.

more...