Recommended Free Tools
In January 2019, researchers disclosed a flaw chain that could let an attacker take over a Fortnite account without learning its password—but the victim still had to click a crafted link. Check Point said Epic Games fixed the vulnerabilities; the disclosure is historical, not evidence that the same attack works today or that accounts were broadly compromised.
Could someone take over a Fortnite account without your password?
In the specific attack disclosed in 2019, yes: the attacker did not need the victim to type a password into a fake login page. But “without credentials” did not mean “without any action.” The victim had to click a crafted link, which began a chain that could expose an authentication token.
As an Amazon Associate I earn from qualifying purchases.
Check Point Research reported three flaws in Epic Games’ web infrastructure and login process. The researchers described a link that could appear to come from an Epic Games domain. An unvalidated redirect and a vulnerable, unused Epic subdomain helped route the flow to injected JavaScript. That script caused a third-party single sign-on provider to resend an authentication token; the token could then be redirected into an attacker-controlled flow and captured. Check Point’s disclosure and its technical account describe the chain.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Crafted-link click: The victim clicked a link made to look as though it came from Epic.
- Redirect and subdomain weaknesses: The link used flaws in Epic’s web and sign-in flow.
- Token capture: Injected script caused a single sign-on provider to resend an authentication token, which could be captured by the attacker.
- Account access: With the token, the attacker could act as the account holder without supplying the password again.
The reported chain involved token-based sign-in through third-party providers. Check Point named Facebook, Google and Xbox as examples at the time; that list is not a statement of Epic’s current sign-in options.
#1 Best Overall
- Code for Bonus Virtual Item Included – Tooth Pick Pickaxe
- Hall Effect Thumbsticks and Triggers – Contact-free magnetic sensors in the thumbsticks and triggers provide a more fluid pro-level feel to help with precision and longevity
- Low Latency Wireless – Play wirelessly on Xbox Series X|S, Xbox One, and Windows 10/11 using the included Wireless USB Adapter
- Advanced Gaming Buttons – Get an edge over the competition with 4 mappable buttons that you can program on the fly, mid-game—no system settings to configure
- 3-Way Trigger Locks – Set the travel distance of the triggers with three different positions to pull off quicker actions in your favorite FPS games or go full throttle in a high-end race car
What could an attacker do with a captured token?
Check Point said a stolen token could potentially give an attacker access to account information, in-game contacts, purchases using payment-card details, and in-game or related conversations. These were described as possible consequences of the flaw, not a tally of confirmed victims or proof that attackers used this chain against players.
The incident’s significance was therefore broader than password exposure: the token could function as proof of an authenticated session. Check Point researcher Oded Vanunu warned of the privacy risk, saying, “These flaws provided the ability for a massive invasion of privacy.” TechCrunch’s contemporaneous report also quoted Vanunu on why an Epic-domain URL could appear transparent to users and evade suspicion.
Rank #2
- Now Including Hall Effect Modules – Say goodbye to stick drift with contact-free magnetic sensors in the thumbsticks giving you smoother control, enhanced precision, and increased longevity
- Code for Bonus Virtual Item Included – Moon Bounce Emote
- 2 Types of Glow – Bring the spirit of the arcade to your controller with a glow in the dark effect and a reaction when a UV light is applied giving off a fluorescent glow
- Advanced Gaming Buttons – Get an edge over the competition with two mappable buttons you can program on-the-fly, mid-game—no system settings to configure
- 3-Way Trigger Locks – Set the travel distance of the triggers with three different positions to pull off quicker actions in your favorite FPS games or go full throttle in a high-end race car
Did Epic fix the Fortnite account vulnerability?
Yes, according to the contemporaneous statements. Check Point said it notified Epic and that the vulnerability had been fixed. Epic spokesperson Nick Chester told TechCrunch, “We were made aware of the vulnerabilities and they were soon addressed,” and thanked Check Point for reporting them.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The sources do not give a precise patch date, affected build or version list, or public CVE identifier. The disclosure was published on January 16, 2019. It should not be treated as proof that the same flaws remain exploitable, or as evidence that current Epic accounts are compromised.
Rank #3
- Now Including Hall Effect Modules – Say goodbye to stick drift with contract-free magnetic sensors in the thumbsticks giving you smoother control, enhanced precision, and increased longevity
- Advanced Gaming Buttons – Get an edge over the competition with two mappable buttons you can program on-the-fly, mid-game—no system settings to configure
- 3-Way Trigger Locks – Set the travel distance of the triggers with three different positions to pull off quicker actions in your favorite FPS games or go full throttle in a high-end race car
- Dual Rumble Motors – Take your gaming experience to the next level, providing tactile feedback and sensations that bring your virtual worlds to life
- Immersive Impulse Triggers – Provides reactive rumble sensations using built-in motors so you can feel the action of the game*
What should you do if someone accessed your Epic account?
For suspected unauthorized access, use Epic’s customer-support route rather than its vulnerability-reporting channel. Epic’s security page directs players with account-access issues to support. Epic’s Terms of Service say users should notify support if they suspect unauthorized account access and are responsible for maintaining account security.
- Contact Epic Support about an account you cannot access or activity you do not recognize.
- Follow Epic’s account-recovery instructions and secure the email account associated with your Epic account.
- Use a strong, unique password and do not share account information. These were also among Epic spokesperson Nick Chester’s recommendations in 2019; they are sensible precautions, not a guarantee against every form of account takeover.
- For a security flaw you have discovered, use Epic’s security reporting options, including its security email or HackerOne program. That channel is for vulnerability disclosure, not routine login help.
What did two-factor authentication do in this incident?
Check Point said two-factor authentication could mitigate the reported account-takeover vulnerability. That is historical guidance about this particular flaw chain, not a promise that two-factor authentication prevents every kind of account compromise.
Quick Recap
Best Value
- Feel you in-game actions and environement simulated through haptic feedback
- Experience varying force and tension at your fingertips with adaptive triggers
- Chat online through the built-in microphone
- Connect a headset directly via the 3.5mm jack
- Switch voice capture on and off using the dedicated mute button
Rank #4
- Made for PC, Cloud, and Mobile - Optimized for gaming on PC desktops and laptops. Connect to cloud gaming devices such as compatible Smart TVs, and Android smartphones and tablets
- Bonus Fortnite virtual item included (Assault Bomber)
- Hall Effect Thumbsticks and Triggers - Reliable Hall Effect sensors built into the thumb sticks and triggers deliver a more precise and fluid response
- 3 Connection Options - Reliable connection via low-latency 2.4GHz wireless, Bluetooth, or Wired USB for the most flexibility on various gaming devices
- Mappable Buttons - Boost your effectiveness with 4 customizable Advanced Gaming Buttons that let you adapt to any gaming experience
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
