Auth bypass · critical
The header the reverse proxy forgot to strip
The back office trusted an identity header that the edge only stripped on one of the two routes it exposed.
· 2 min read $2.5k - $5k
Auth bypass · critical
Six digits, one request: brute-forcing an OTP through GraphQL aliases
The rate limiter counted HTTP requests. GraphQL aliases let me put ten thousand verification attempts inside one of them.
· 2 min read $2.5k - $5k
Auth bypass · critical
The kid header that accepted a path
The JWT library looked up the signing key by filename. The filename came from the token, and nobody checked it stayed in the keys directory.
· 1 min read $2.5k - $5k