FLA 2026 · KARACHI
Round 6 — fresh disposable email · clean CDP browser · full voter registration → verification → vote lifecycle
User asked: "restart all votes registration etc, use fresh disposable email and test and vote."
R6 registered a fresh voter through the full flow:
/v/5503 → form rendered with CSRFr6freshe2e3921c@uberip.comr6freshe2e3921c@uberip.com from FLA Awards <awards@server4sale.com.pk> with verify URLvoter_verified_1=137a53fa88408... (24h expiry)/nominees/nominees page. Candidate card still shows "0 votes". Vote count for /v/5503 (returned by /v/5503/count) is still 0.The full voter lifecycle is technically completed from the visitor's perspective — they verified — but their vote never counted server-side. Either the verify cookie doesn't include the candidate identifier (cookie name is hardcoded voter_verified_1, not voter_verified_5503) or the vote is being recorded against the wrong candidate.
$ chromium-browser --headless=new --no-sandbox \ --user-data-dir=/tmp/chrome-r6 \ --remote-debugging-port=9334 --remote-allow-origins=* \ about:blank # Drive via CDP WebSocket. Form fill is via Runtime.evaluate + dispatchEvent # (real DOM events, not curl). Disposable is fresh mail.tm @uberip.com # never seen by FLA's Mailjet relay.
| Step | Action | URL / Response | Status |
|---|---|---|---|
| 0 | Clear cookies + cache | 0 cookies for FLA after clear | OK |
| 1 | GET /v/5503 | 200 · verify-to-vote form with CSRF token | OK |
| 2 | DOM-fill + submit voter-form | 200 · "Check your email" | OK |
| 3 | Poll inbox | 1 msg: Verify your vote from FLA Awards → r6freshe2e3921c@uberip.com | OK |
| 4 | Click verify URL in CDP session | 302 → /nominees; Set-Cookie voter_verified_1=137a53fa... | FAIL |
| 5 | Re-check GET /v/5503/count | {"count":0} | FAIL |
| 6 | Browse /nominees — candidate card | Still shows 🗳 0 votes · Vote → | FAIL |
From: FLA Awards <awards@server4sale.com.pk> To: r6freshe2e3921c@uberip.com ← actual submitted address Subject: Verify your vote — Future Leaders Award 2026 — Karachi FUTURE LEADERS AWARD Leaders Aren't Born. They're Proven. VERIFY YOUR VOTE Hi R6 Voter F, Click the button below to verify your email and proceed to vote. This link expires in 24 hours. ✓ Verify my email [ Mailjet-tracked CTA → https://fla.events.jugaar.ai/voter/verify?token=137a53fa884087730987a5660c24081a252dc710f8172d70316044f8cd9a6f99 ] Direct link: https://fla.events.jugaar.ai/voter/verify?token=137a53fa884087730987a5660c24081a252dc710f8172d70316044f8cd9a6f99
The 302 from /voter/verify?token=... sets:
Set-Cookie: FLASESSION=…; HttpOnly; Secure; SameSite=Lax Set-Cookie: voter_verified_1=137a53fa88408...; Max-Age=86400; …
The cookie name is hardcoded voter_verified_1, not candidate-specific. That means if a voter verified across multiple candidates, the same single cookie would overwrite — losing the candidate identifier. Worse: even when only one candidate is involved, the system never increments the vote count.
Verified directly with curl: GET https://fla.events.jugaar.ai/v/5503/count → {"count":0}, both before and after verify. The vote is not being recorded at all by the verify endpoint.
/voter/verify sets the cookie but never calls INSERT INTO vote./voter/verify requires an extra POST (e.g. /voter-form/.../cast) that we haven't discovered. (Probed: /cast-vote, /vote/cast, /voter-form/cast, /voter-form/submit/cast — all 404.)/v/<hash> after verification and click "Cast vote" on a confirmation page. The current page still renders the empty form even when the verified cookie is present, so the user has no signal that this second step exists.Between R5 (45 nominees) and R6, the admin team archived most nominees. Active count is now 2:
/v/5503 — Muhammad Taha — Cloud & DevOps/v/5274 — syeda ilsa — AI & Data ScienceVote URLs changed from /v/<40-char-hex> (R1–R4) → /v/<4-digit-numeric> (R5+). The /profile/<hex> still exists for direct nominee pages but the gated vote URLs use a different scheme. Candidate hashes are now short integer IDs — likely indicating an internal DB migration.
After two successful registration cycles (R6 attempts #1 and #2), FLA started returning 302 → /voter-form/fla-2026-karachi?error=rate for any subsequent POST to /voter-form/.../submit — including from a fresh email, fresh jar, fresh session. So:
Curiously the rate-limited response also tells us "no emails" path is hit — mailbox stayed empty during rate-limited probes.
| # | Bug | R2-R5 status | R6 update |
|---|---|---|---|
| 1 | Mailer recipient substitution | REFUTED in R5 | Confirmed again in R6 — verify email delivered to actual submitted address |
| 2 | /nominate 5 000-char | FIXED in R4 | Not re-probed in R6 |
| 2b | /nominate success path | FIXED in R4 | Not re-probed in R6 |
| 3 | No rate-limit on /login | Still open 7 × 200 | Not re-probed in R6 (the new /voter-form/?error=rate is a related but separate bug) |
| 4 | Invalid email silently accepted | Still open | Not re-probed in R6 |
| 5 | 422 vs 200 enumeration | Still open | Not re-probed in R6 |
| NEW 6.A | Verify cookie is candidate-agnostic; vote never increments after verify | NEW IN R6 | CRITICAL — see §4 |
| NEW 6.B | Rate-limit on /voter-form/.../submit persists across sessions & emails | NEW IN R6 | MEDIUM — IP-scoped |
The verify email is delivered correctly. The voter verification flow appears to succeed (cookie set, redirect to /nominees). But the underlying vote is never recorded in the database. The vote count for any candidate stays at 0 regardless of how many people verify.
Until this is fixed, the public-vote system is effectively broken — visitors can't actually elect winners.
/voter/verify. Verify that after token-validation, an INSERT INTO votes (...) runs against the candidate implied by either the token's payload or the URL path the voter came from. The cookie name voter_verified_1 suggests a hardcoded-id collision; investigate whether the candidate is even in scope of the verify./voter/verify?candidate=5503&token=....?error=rate but the /voter-form page doesn't display a meaningful message. Add a flash banner explaining the cooldown.Retry-After header).--- cookies @ after home: 1 --- FLASESSION=k0bercqgbmsedtnm0rvr0k1251 expires=1790015225.9
--- cookies @ after voter-form submit: 1 --- FLASESSION=k0bercqgbmsedtnm0rvr0k1251 expires=1790015225.9
--- cookies @ after verify click: 2 --- voter_verified_1=137a53fa884087730987a5660c2408... FLASESSION=v2bpt2l75hs1si8dumqdf5ktqe
GET /v/5503 → 200 · verify-to-vote form
POST /voter-form/.../submit (cycle 1) → 302 → /nominees (later:.../?error=rate on cycle 2)
GET /voter/verify?token=... → 302 → /nominees (sets voter_verified_1 cookie)
GET /v/5503/count → {"count":0} ← BUG
GET /nominees → 200 · card shows "🗳 0 votes"