u/Ok_Substance_1354

I've seen a lot of people talk about the verification code exploit without really understanding what it was, so I wanted to lay it all out clearly. This has been patched by Ubisoft now, so there's no risk in explaining it.

Verification tokens, the ones you generate in-game for the code redemption website (https://redeem.invincible.ubisoft.barcelona/), could be used to extract permanent login credentials for that player's account. Not temporarily. Permanently.

The game communicates with Ubisoft's servers using gRPC, which is basically a way for the app to call specific functions on the server. One of those functions was called transferAccount, part of a service called CloudSaveService.

You call AuthService.init, which creates a brand new temporary account on Ubisoft's servers. No device needed, a raw server call. It hands back a temporary account ID and secret.
You log into that temp account using AuthService.login, which gives you a session token.
You take someone's verification token and pass it to CloudSaveService.transferAccount using that session token.
The server responds with a permanent account_id and secret pair for the real player's account. Not the temp account. The actual player.
From that point on, you could log into their account whenever you wanted using AuthService.login with those credentials. No verification token needed again. The credentials never expired.

The verification token was never meant to carry that much power, but the server treated it as proof of ownership and handed over the keys.

Anyone who had access to a player's verification token, whether they intercepted it, were given it, or even just saw it in a screenshot, could silently extract permanent credentials for that account. The player would never know. There was no notification, no session kick, nothing.

The credentials worked for any authenticated gRPC call. Redeeming codes, yes, but also anything else the server exposed to authenticated users. Viewing account data, heroes, gear, currencies, whatever the API allowed.

What worried me was that I couldn't realistically be the only person who had found this. The transferAccount endpoint was sitting right there in the game's binary. Anyone who decompiled the app and looked at the gRPC service definitions would see it. The method name alone basically tells you what it does. If someone with bad intentions found it before Ubisoft got around to fixing it, players would have been losing their accounts with no explanation.

Ubisoft has since patched the transferAccount flow. Verification tokens can no longer be used to extract permanent credentials this way. So if you've used the code redemption tool or generated a verification token in the past, you're fine. There is nothing to worry about.

I also want to be clear that the code redeemer tool was never the vulnerability. The vulnerability was entirely server-side. It existed whether the redeemer tool existed or not. Anyone with a basic understanding of gRPC could have done this without any tool at all.

An early look at Damien Darkblood (Under Realm) — By The Invincibles

Bootcamp Seniority Tiers

An Early look at Brit — by The Invincibles

Boss Raid Gamemode - by The Invincibles

Brit skills, tags, and more — by The Invincibles

Bootcamp Event Shop Rewards Are Based on Your Total Login Days — By The Invincibles

The Verification Token Vulnerability — How It Actually Worked

Volcanikka skills, tags, and more — by The Invincibles

An early look at Volkanica — by the Invincibles

Thaedus Event Teaser