π¨ New Bug Bounty Writeup
How I Found a Bug Worth $3,500 in a Feature Nobody Was Watching
This writeup details the discovery of a high-impact vulnerability hidden in an overlooked feature. It walks through the reconnaissance process, testing methodology, exploitation steps, and key lessons that led to a $3,500 bug bounty reward.
π Read the full writeup: https://infosecwriteups.com/how-i-found-a-bug-worth-3-500-in-a-feature-nobody-was-watching-6773df9fce72β οΏ½
How I Found a Bug Worth $3,500 in a Feature Nobody Was Watching
This writeup details the discovery of a high-impact vulnerability hidden in an overlooked feature. It walks through the reconnaissance process, testing methodology, exploitation steps, and key lessons that led to a $3,500 bug bounty reward.
π Read the full writeup: https://infosecwriteups.com/how-i-found-a-bug-worth-3-500-in-a-feature-nobody-was-watching-6773df9fce72β οΏ½
Medium
How I Found a Bug Worth $3,500 β In a Feature Nobody Was Watching.
A storage-exhaustion flaw. A stored XSS that waited for an admin. Both hiding in the same βboringβ file upload form that hadnβt beenβ¦
π₯3
π¨ New Bug Bounty Writeup
From Nothing to Full Admin Access: Chaining Broken Access Controls
This writeup demonstrates how multiple broken access control vulnerabilities were chained together to escalate privileges from a low-privileged user to full administrator access. A practical example of why combining seemingly low-severity issues can lead to critical impact.
π Read the full writeup: https://infosecwriteups.com/from-nothing-to-full-admin-access-chaining-broken-access-controls-f0d5aa76a4c1β οΏ½
From Nothing to Full Admin Access: Chaining Broken Access Controls
This writeup demonstrates how multiple broken access control vulnerabilities were chained together to escalate privileges from a low-privileged user to full administrator access. A practical example of why combining seemingly low-severity issues can lead to critical impact.
π Read the full writeup: https://infosecwriteups.com/from-nothing-to-full-admin-access-chaining-broken-access-controls-f0d5aa76a4c1β οΏ½
Medium
From Nothing to Full Admin Access: Chaining Broken Access Controls
Broken Access Controls are everywhere. In application security, they show up in many different ways. Sometimes they come from poorlyβ¦
π₯2
π¨ New Bug Bounty Writeup
Broken Access Control: Platform Misconfiguration & URL Override Headers
This writeup explores how platform misconfigurations and URL override headers can introduce broken access control vulnerabilities. Learn how these overlooked behaviors can be abused to bypass authorization checks and why testing alternative headers should be part of every bug bounty assessment.
π Read the full writeup: https://medium.com/@anubhavbora40/broken-access-control-platform-misconfiguration-url-override-headers-5a8ac59ace15β οΏ½
Broken Access Control: Platform Misconfiguration & URL Override Headers
This writeup explores how platform misconfigurations and URL override headers can introduce broken access control vulnerabilities. Learn how these overlooked behaviors can be abused to bypass authorization checks and why testing alternative headers should be part of every bug bounty assessment.
π Read the full writeup: https://medium.com/@anubhavbora40/broken-access-control-platform-misconfiguration-url-override-headers-5a8ac59ace15β οΏ½
Medium
Broken Access Control β Platform Misconfiguration (URL Override Headers)
The Core Problem
β€2
π¨ New Bug Bounty Writeup
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
This writeup explores two structural inspection gaps in AWS WAF that can allow SQL injection payloads to evade detection. Learn the techniques used to bypass WAF protections, understand the root cause, and improve your approach to testing modern web applications behind managed firewalls.
π Read the full writeup:
https://prathameshbagul.medium.com/getting-sql-injection-past-aws-waf-two-structural-inspection-gaps-5c1148f2e49dβ
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
This writeup explores two structural inspection gaps in AWS WAF that can allow SQL injection payloads to evade detection. Learn the techniques used to bypass WAF protections, understand the root cause, and improve your approach to testing modern web applications behind managed firewalls.
π Read the full writeup:
https://prathameshbagul.medium.com/getting-sql-injection-past-aws-waf-two-structural-inspection-gaps-5c1148f2e49dβ
Medium
Getting SQL Injection Past AWS WAF: Two Structural Inspection Gaps
How zlib-compressed URL tokens and request-body padding exposed gaps between AWS WAF inspection and application processing.
π₯3
π¨ New Bug Bounty Writeup
CVE-2026-69258: Flowise Patched OverrideConfig β I Found the Two Places the Patch Never Reached
This writeup analyzes the patch for CVE-2026-69258 in Flowise and reveals two overlooked code paths where the fix wasn't applied. It highlights the importance of verifying security patches thoroughly and demonstrates how incomplete fixes can leave applications vulnerable.
π Read the full writeup:
https://medium.com/@aviral23/cve-2026-69258-flowise-patched-overrideconfig-i-found-the-two-places-the-patch-never-reached-cb907387cbbeβ
CVE-2026-69258: Flowise Patched OverrideConfig β I Found the Two Places the Patch Never Reached
This writeup analyzes the patch for CVE-2026-69258 in Flowise and reveals two overlooked code paths where the fix wasn't applied. It highlights the importance of verifying security patches thoroughly and demonstrates how incomplete fixes can leave applications vulnerable.
π Read the full writeup:
https://medium.com/@aviral23/cve-2026-69258-flowise-patched-overrideconfig-i-found-the-two-places-the-patch-never-reached-cb907387cbbeβ
Medium
CVE-2026β69258: Flowise Patched overrideConfig. I Found the Two Places the Patch Never Reached.
An unauthenticated property injection into the flow execution context of any public chatflow. The gate was already in the codebase. It justβ¦
β€2
π¨ New Bug Bounty Writeup
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage and Account Takeover Risks
Explore common OAuth 2.0 security weaknesses, including redirect URI issues and token leakage, and learn how these flaws can potentially be chained into account takeover scenarios. A useful guide for understanding and testing OAuth attack surfaces during bug bounty hunting.
π Read the full writeup:
https://medium.com/@cybermindspace/oauth-2-0-attack-surface-redirect-uris-token-leakage-and-account-takeover-risks-7d0f0730168bβ
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage and Account Takeover Risks
Explore common OAuth 2.0 security weaknesses, including redirect URI issues and token leakage, and learn how these flaws can potentially be chained into account takeover scenarios. A useful guide for understanding and testing OAuth attack surfaces during bug bounty hunting.
π Read the full writeup:
https://medium.com/@cybermindspace/oauth-2-0-attack-surface-redirect-uris-token-leakage-and-account-takeover-risks-7d0f0730168bβ
Medium
OAuth 2.0 Attack Surface: Redirect URIs, Token Leakage, and Account Takeover Risks
Apple paid $100,000 for this one. The researcher found it in an afternoon. The server issued OAuth tokens for any email address you askedβ¦
π2
π¨ New Bug Bounty Writeup
How I Landed My First $200 Bounty with One Unusual SSRF
A practical writeup about discovering an unusual Server-Side Request Forgery (SSRF) vulnerability and turning it into a successful $200 bug bounty. A great example of thinking beyond common attack paths and exploring unexpected SSRF behavior.
π Read the full writeup:
https://meetcyber.net/how-i-landed-my-first-200-bounty-with-one-unusual-ssrf-9464df0720b1β
How I Landed My First $200 Bounty with One Unusual SSRF
A practical writeup about discovering an unusual Server-Side Request Forgery (SSRF) vulnerability and turning it into a successful $200 bug bounty. A great example of thinking beyond common attack paths and exploring unexpected SSRF behavior.
π Read the full writeup:
https://meetcyber.net/how-i-landed-my-first-200-bounty-with-one-unusual-ssrf-9464df0720b1β
Medium
I Found an SSRF That Nobody Would Screenshot β So I Made It Screenshot Itself
$200 for one SSRF bug most hunters would've missed - a screenshot renderer leaking internal metrics. My first bounty, full breakdown.
β€3
π¨ New Bug Bounty Writeup
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
This writeup explores how weak MIME type validation in a file upload feature can lead to serious security impact, including Remote Code Execution (RCE). A useful practical example of testing file upload functionality beyond basic extension checks.
π Read the full writeup:
https://rootvuln.medium.com/from-file-upload-to-remote-code-execution-how-i-bypassed-mime-type-validation-d571e7c27645β
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
This writeup explores how weak MIME type validation in a file upload feature can lead to serious security impact, including Remote Code Execution (RCE). A useful practical example of testing file upload functionality beyond basic extension checks.
π Read the full writeup:
https://rootvuln.medium.com/from-file-upload-to-remote-code-execution-how-i-bypassed-mime-type-validation-d571e7c27645β
Medium
From File Upload to Remote Code Execution: How I Bypassed MIME Type Validation
Introduction
π₯3
π¨ New Bug Bounty Writeup
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI β $12,000 Bounty
This writeup explores how a single unauthenticated GraphQL request led to the compromise of Mozilla Firefox CI, resulting in a $12,000 bug bounty. A great case study on GraphQL security, authentication flaws, and how a seemingly simple endpoint can have major impact.
π Read the full writeup:
https://medium.com/@kenjisubagja/how-a-single-unauthenticated-graphql-request-compromised-mozilla-firefox-ci-12-000-bounty-b6b29bd0becbβ
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI β $12,000 Bounty
This writeup explores how a single unauthenticated GraphQL request led to the compromise of Mozilla Firefox CI, resulting in a $12,000 bug bounty. A great case study on GraphQL security, authentication flaws, and how a seemingly simple endpoint can have major impact.
π Read the full writeup:
https://medium.com/@kenjisubagja/how-a-single-unauthenticated-graphql-request-compromised-mozilla-firefox-ci-12-000-bounty-b6b29bd0becbβ
Medium
How a Single Unauthenticated GraphQL Request Compromised Mozilla Firefox CI β $12,000 Bounty
Overview
π2
π¨ New Bug Bounty Writeup
How I Turned One Admin Account Into a Full Org Takeover
This writeup explores how a single compromised admin account was leveraged to escalate impact into a full organization takeover. A useful case study on privilege escalation, access control weaknesses, and vulnerability chaining in real-world bug bounty hunting.
π Read the full writeup:
https://ameensec.medium.com/how-i-turned-one-admin-account-into-a-full-org-takeover-67f37c19a877β
How I Turned One Admin Account Into a Full Org Takeover
This writeup explores how a single compromised admin account was leveraged to escalate impact into a full organization takeover. A useful case study on privilege escalation, access control weaknesses, and vulnerability chaining in real-world bug bounty hunting.
π Read the full writeup:
https://ameensec.medium.com/how-i-turned-one-admin-account-into-a-full-org-takeover-67f37c19a877β
Medium
How I Turned One Admin Account Into a Full Org Takeover
Note: The targetβs name has been withheld and replaced with example.com, since this report is still under responsible disclosure / privateβ¦
π1
π¨ New Bug Bounty Writeup
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
This writeup explores how an unauthenticated OAuth registration endpoint was chained with other weaknesses to escalate the impact into full account takeover. A practical case study on OAuth security, authentication flaws, and vulnerability chaining.
π Read the full writeup:
https://medium.com/@divakarvasani3938/how-i-chained-an-unauthenticated-oauth-registration-endpoint-into-full-account-takeover-a6bc41e93a62β
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
This writeup explores how an unauthenticated OAuth registration endpoint was chained with other weaknesses to escalate the impact into full account takeover. A practical case study on OAuth security, authentication flaws, and vulnerability chaining.
π Read the full writeup:
https://medium.com/@divakarvasani3938/how-i-chained-an-unauthenticated-oauth-registration-endpoint-into-full-account-takeover-a6bc41e93a62β
Medium
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
A walkthrough of abusing RFC 7591 Dynamic Client Registration left open in production
β€2
π¨ New Bug Bounty Writeup
Unauthenticated Mass Data Deletion: When Delete Has No Auth Check
This writeup explores a critical authorization flaw where a deletion endpoint lacks proper authentication checks, potentially allowing unauthorized users to trigger mass data deletion. A practical case study on broken access control and the importance of testing destructive endpoints.
π Read the full writeup:
https://medium.com/@divakarvasani3938/unauthenticated-mass-data-deletion-when-delete-has-no-auth-check-07a095f37aa9β
Unauthenticated Mass Data Deletion: When Delete Has No Auth Check
This writeup explores a critical authorization flaw where a deletion endpoint lacks proper authentication checks, potentially allowing unauthorized users to trigger mass data deletion. A practical case study on broken access control and the importance of testing destructive endpoints.
π Read the full writeup:
https://medium.com/@divakarvasani3938/unauthenticated-mass-data-deletion-when-delete-has-no-auth-check-07a095f37aa9β
Medium
Unauthenticated Mass Data Deletion: When DELETE Has No Auth Check
Finding and proving a cross-user resource deletion vulnerability through JS bundle analysis and sequential ID enumeration
π₯2
π¨ New Bug Bounty Article
COM OLHO and the Future of Bug Bounty in India: Why We Need to Stop Eating Our Own
A thought-provoking look at the future of the bug bounty community in India, exploring COM OLHO, community culture, collaboration, and why supporting fellow researchers is important for building a stronger security ecosystem.
π Read the full article:
https://medium.com/@RaunakGupta1922/com-olho-and-the-future-of-bug-bounty-in-india-why-we-need-to-stop-eating-our-own-2db1e50ef930β
COM OLHO and the Future of Bug Bounty in India: Why We Need to Stop Eating Our Own
A thought-provoking look at the future of the bug bounty community in India, exploring COM OLHO, community culture, collaboration, and why supporting fellow researchers is important for building a stronger security ecosystem.
π Read the full article:
https://medium.com/@RaunakGupta1922/com-olho-and-the-future-of-bug-bounty-in-india-why-we-need-to-stop-eating-our-own-2db1e50ef930β
Medium
Com Olho and the Future of Bug Bounty in India: Why We Need to Stop Eating Our Own
Views are my own(I have reports pending on Com Olho, so technically Iβm a shareholder in their backlog)
π2
π¨ New Bug Bounty Writeup
The Biggest Mistake Bug Hunters Make After Finding an Open Redirect β And How Experts Turn It Into a...
Finding an Open Redirect is often just the beginning. This writeup explores the common mistakes hunters make after discovering one and how experienced researchers investigate its potential impact and turn a seemingly low-impact issue into a more valuable finding.
π Read the full writeup:
https://sayemeh.medium.com/the-biggest-mistake-bug-hunters-make-after-finding-an-open-redirect-and-how-experts-turn-it-e520257043eaβ
The Biggest Mistake Bug Hunters Make After Finding an Open Redirect β And How Experts Turn It Into a...
Finding an Open Redirect is often just the beginning. This writeup explores the common mistakes hunters make after discovering one and how experienced researchers investigate its potential impact and turn a seemingly low-impact issue into a more valuable finding.
π Read the full writeup:
https://sayemeh.medium.com/the-biggest-mistake-bug-hunters-make-after-finding-an-open-redirect-and-how-experts-turn-it-e520257043eaβ
Medium
The Biggest Mistake Bug Hunters Make After Finding an Open Redirect-And How Experts Turn It Into a Critical
1. The 30-Second Refresher: What an Open Redirect Is
π₯2