Random Account Access Glitch

[Twillie]

There’s currently a glitch on site where, at random pages, it will appear like you’re logged into another user’s account, allowing you to see certain info like pets, neopoints, items, etc. It’s unknown if this glitch allows you to actually make changes to these other accounts, but now would still be a good time to update your PIN so no account changes can be made without it. It’s also unknown at this time if logging out will help prevent others from potentially seeing your account.

Will update as more info comes out.

[Twillie]

Just as I post this, site goes down for maintenance. Hopefully it can be fixed soon!

[Blueysicle]

...I'm starting to feel at this point that Neopets code is less like spaghetti and more like Jenga.

[Breakingchains]

Ooh that's nuts. Doesn't sound like anything actually got compromised, but either way I hope it's fixed soon, my weekly reward this week is a plushie poogle mp lol 😬

[Celestial]

I don't even play anymore, so I'm alright, but how the hell does this even happen? xDD;;

[Blueysicle]

Site's back up now. For me at least, things seem to be in order at a glance.

[downrightdude]

I still have an error.

*breaks into people's houses while they're distracted*

[Stephanie (swordlilly)]

Nov 20, 2023 17:13:51 GMT -5 downrightdude said:

I still have an error.

I had the same error. After asking around, it turns out that if you manually remove the "www" in your URL, the site will let you back in. (As in, go to "https://neopets.com/" instead of "https://www.neopets.com/")

The caveat is that most games don't work without the "www." The only game that works and counts for the quest log is AAA's Revenge.

We live in interesting times x'D

Nov 20, 2023 14:11:23 GMT -5 Celestial said:

how the hell does this even happen? xDD;;

Here's a layman's explanation given by someone on the Neopets discord that I found helpful for understanding what happened xD

The neopets server saves a "snapshot" of what each user's pages should look like to save processing power on the server. That way instead of loading straight from the server, a user can just reload most of the page data from their saved snapshot, their own personal cache. However, instead of making sure each user receives their own personal cache, any account that had cached pages recently (ie: users who had been logged in/loaded pages recently) had those snapshots distributed to whoever loaded their page without checking to see if it was even the correct cache.

It's like if you gave your coat to the coat check to save the inconvenience of lugging it around and when you came back they just gave you whichever coat was closest to the person working there.
"This isn't even my coat"
"Oh. what about this one"
"This, too, is not my coat"
"Ma'am its not my job to make sure the coat is yours it's just my job to hand you a coat"

Anyway if this is the case the issue was largely visual because any data changes (bank withdrawals, pet transfers, buying or removing or generating items) would be new info, and so would bypass the cache and go straight into the neo servers and load the correct up to date info for that user. Which is why clicking on something on the site would appear to take you back to your account.

TL;DR: Everyone's pets and items are safe, and the crisis has been averted for now

[downrightdude]

Thank goodness it's working today! I got my 100K from Trudy!

[Breakingchains]

Looks like it's been confirmed that you couldn't actually make changes to another person's account during the glitch. It was a caching issue that occurred while they upgraded some system stuff, and though it would show you other accounts, it didn't actually give you access--you could "look but not touch," so to speak.

That's a relief, nobody would have gotten idk their UCs pounded or something

(Additionally, yay for upgrading system stuff! 🎉)

[Twillie]

Here's the official update from TNT on Twitter:

We know yesterday’s outage was very stressful for our community, and we’re here to provide you all with an update. Firstly, thank you to our incredible players for their patience, understanding, and for being so vigilant.

On Monday, 20th November at approximately 8:30AM PST, we were alerted to an issue on-site where users were finding themselves logged into incorrect accounts. The site was taken down shortly after for emergency maintenance to protect our players. We remained offline while our team conducted thorough investigations and fixes.

Unfortunately, this cache error occurred as we are in the midst of upgrading our infrastructure and service provider. We can confirm that while players may have appeared in other accounts, no changes were made to accounts. We understand that this was a major concern for our players but rest assured your account remains unchanged and as you left them.

Services are now operating normally and The Neopets Team is continuing to monitor the site closely. Our system migration will be complete by 22th November 2023. If you are still experiencing any issues, please contact our Customer Support team by submitting a ticket here: support.neopets.com/hc/en-us/requests/new. We truly apologise for the inconvenience and concern this may have caused. Thank you to everyone who submitted reports, and for supporting us as we worked hard to bring Neopets.com back up and running!