---
title: "Comment by zijian xiao on \"$9240 Bounty in 30 days Hunt Challenge\" | Hashnode"
description: "The 2FA Bypass with Grant Access section is not very clear. The redirect must be victim@gmail.com. If the redirect is to victi.m@gmail.com, the user is a new us"
url: "https://hashnode.com/posts/9240-bounty-in-30-days-hunt-challenge/65340812183f53029f4b7b18/comment/67aea99387075498e739bfd7"
---

[Discussion](https://hashnode.com/posts/9240-bounty-in-30-days-hunt-challenge/65340812183f53029f4b7b18)

Comment [$9240 Bounty in 30 days Hunt Challenge](https://hashnode.com/posts/9240-bounty-in-30-days-hunt-challenge/65340812183f53029f4b7b18)

[zijian xiao](https://hashnode.com/@m4ra7h0n)

[Feb 14, 2025](https://hashnode.com/posts/9240-bounty-in-30-days-hunt-challenge/65340812183f53029f4b7b18/comment/67aea99387075498e739bfd7)

The 2FA Bypass with Grant Access section is not very clear. The redirect must be victim@gmail.com. If the redirect is to victi.m@gmail.com, the user is a new user, and 2FA is not enabled

[zijian xiao](https://hashnode.com/@m4ra7h0n)

[Feb 14, 2025](https://hashnode.com/posts/9240-bounty-in-30-days-hunt-challenge/65340812183f53029f4b7b18/comment/67aea99387075498e739bfd7#reply-67aeaaaae225fe49b468b541)

However, if you are signing up for a new user victi.m@gmail.com, the link must also go to victi.m@gmail.com, so it is impossible to bypass 2FA at victim@gmail.com