The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-10-31 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 news 11 min read RCE XSS | Library detailing CVE-2026-109618 and CVE-2026-109619, PHP2Shell vulnerabilities, alongside an analysis of AI's impact on bug bounty programs. It also covers proactive security strategies for AI companies, changes to ID verification in bug bounty programs, and the results of the Intigriti 1026 CTF. Additionally, it highlights exploit chains for Microsoft Edge and Discord, a Chrome full-chain bounty, XSS in Cloudflare, and Google RCE via Flask session pickle deserialization. Resources include HexStrike AI and Claude-OSINT for automated reconnaissance. → intigriti.com |
| 2026-10-31 2026 | Github Authentication Bypass on Major CRM intermediate AuthN | A security researcher discovered a critical authentication bypass vulnerability on a major CRM platform accessible via GitHub. This vulnerability could allow unauthorized access to sensitive customer data. The researcher responsibly disclosed the finding, and the CRM provider is reportedly addressing the issue. |
| 2026-10-31 2026 | CWE-540 in the Wild: Hardcoded Credentials in a Production Analytics Script intermediate Secrets | A production analytics script was found to contain hardcoded credentials, a vulnerability categorized as CWE-540. This oversight, often stemming from a "we'll clean that up later" mentality, exposes sensitive information. The article highlights the real-world danger of such practices in production systems. |
| 2026-10-31 2026 | Advanced Mobile Application Penetration Testing: Complete Lab Setup and Tools Guide advanced Mobile | This guide focuses on setting up a comprehensive lab environment for advanced mobile application penetration testing. It covers essential tools and configurations needed to conduct in-depth security assessments of mobile apps. The content is designed for professionals looking to master techniques for identifying vulnerabilities in banking, e-commerce, and other critical mobile services. |
| 2026-10-31 2026 | Pentesting/Bug Bounty d’une Application Mobile : Analyse dynamique. intermediate Burp Mobile | This content focuses on the dynamic analysis phase of mobile application pentesting and bug bounty hunting. It explores techniques and methodologies used to identify vulnerabilities in mobile apps by observing their behavior and interactions during runtime. The goal is to uncover security flaws that might not be apparent through static analysis alone. |
| 2026-10-31 2026 | A Sub-User Could Delete a Company in Munshi intermediate AuthZ | A security vulnerability was discovered in Munshi that allowed a sub-user to delete a company. This could have significant implications for businesses using the platform. The issue was identified and is likely being addressed to prevent unauthorized data loss and maintain system integrity. |
| 2026-10-31 2026 | Spring4Shell Step by Step: How CVE 2022 22965 Turns Data Binding Into Remote Code Execution in a… intermediate RCE | This content details the "Spring4Shell" vulnerability (CVE 2022 22965), explaining how it exploits data binding mechanisms within the Spring Framework to achieve remote code execution. The vulnerability arises from specific configurations and the use of `web.xml` or the absence of specific Spring configurations. Attackers can leverage this to overwrite arbitrary files on a server. |
| 2026-10-31 2026 | From Shodan to an Unpaid Delivery: How a Chain of Weaknesses Led to Real-World Impact intermediate | This article details a security researcher's journey from discovering a weak credential on Shodan to uncovering a chain of vulnerabilities with real-world consequences. The researcher leveraged Shodan to find a vulnerable device, which then led to access to a system controlling delivery logistics. This access allowed the researcher to manipulate delivery information, resulting in an unpaid delivery. The narrative highlights how seemingly minor initial findings can escalate into significant impacts when multiple weaknesses are chained together. |
| 2026-10-31 2026 | Giving an AI Agent a File Reader Without a Fence: Arbitrary File Read in an AWS Open-Source Tool intermediate AI | An AWS open-source tool, designed to provide AI agents with file reading capabilities, has a critical vulnerability. This flaw allows an AI agent to perform arbitrary file reads on any path accessible by the tool's execution environment. Effectively, by giving the AI agent a file reader without proper security restrictions ("without a fence"), the tool exposes sensitive data to unauthorized access. This could lead to significant security breaches if the AI agent is compromised or malicious. |
| 2026-10-31 2026 | ProxyShell Step by Step: How Three Exchange Flaws Chain Into Remote Code Execution in a Lab intermediate RCE | This article details the step-by-step process of achieving Remote Code Execution (RCE) on Microsoft Exchange Server by chaining three vulnerabilities. The exploit, dubbed ProxyShell, leverages flaws in the Exchange PowerShell backend to bypass authentication and execute arbitrary code. The researchers successfully demonstrated this attack in a lab environment, highlighting the severity of these vulnerabilities when combined. The content focuses on the technical exploitation path and the conditions required to achieve RCE. |
| 2026-10-31 2026 | From Out of Scope XSS to Account Takeover: The Iframe Sandwich (OWASP talk) intermediate AuthN Talks XSS | This OWASP AppSec Days Portugal 2026 talk by Dinis Costa, "From Out-of-Scope XSS to Account Takeover: The Iframe Sandwich," explores a security vulnerability. The presentation likely details how an initially out-of-scope Cross-Site Scripting (XSS) flaw, when combined with an "iframe sandwich" technique, can be escalated to achieve a full account takeover. The content is presented as a video by the OWASP Foundation on YouTube. |
| 2026-10-31 2026 | IDOR Hunting Techniques Every Bug Bounty Hunter Should Know | by Samadhan Shimple intermediate AuthZ IDOR | This article by Samadhan Shimple outlines essential IDOR (Insecure Direct Object Reference) hunting techniques for bug bounty hunters. It covers common methods and strategies to discover IDOR vulnerabilities, which occur when an application allows users to access objects they are not authorized to, often by manipulating parameters like IDs in URLs. The piece aims to equip hunters with the knowledge to effectively identify and report these common security flaws. |
| 2026-10-31 2026 | How a Sneaker Order Led Me to an IDOR Vulnerability (and $50) intermediate AuthZ IDOR | A security researcher discovered an Insecure Direct Object Reference (IDOR) vulnerability in an online store, stemming from a simple sneaker purchase. This broken access control flaw allowed unauthorized access. The researcher reported the vulnerability and was rewarded with a $50 bounty for their findings. |
| 2026-10-25 2026 | Show HN: Steal My Bitcoin intermediate AuthN AuthZ | "Steal My Bitcoin" is a project, presented on Show HN, that challenges users to find vulnerabilities in its system to steal a designated amount of Bitcoin. The purpose of this initiative is to publicly test and improve the security of the Bitcoin protocol or related systems through ethical hacking. The title directly invites individuals to attempt to exploit weaknesses for a potential reward, highlighting a bug bounty-style approach to security testing. |
| 2026-10-22 2026 | AI raised the floor. The hacker crowd keeps raising the ceiling. news 9 min read AI | Library detailing how AI is evolving bug bounty hunting. It discusses the shift from single prompts to multi-agent, continuous workflows, demonstrating how researchers are building complex systems to automate reconnaissance, test payloads, and generate proofs of concept. The entry highlights that while AI raises the baseline for vulnerability discovery, the diversity of the researcher crowd continues to expand the upper limits of security testing, leading to increased high-severity findings and improved platform validity. → intigriti.com |
| 2026-10-13 2026 | ‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips beginner | Bug bounty hunter Sn0rkY emphasizes the importance of manual testing over over-reliance on automated tools. In his story, he highlights that critical vulnerabilities are often missed by automated scanners. Sn0rkY shares his personal journey and offers top tips for aspiring bug bounty hunters, stressing the value of keen observation, deep understanding of systems, and persistent manual investigation to uncover unique and impactful bugs. → yeswehack.com |
| 2026-10-09 2026 | How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483) news 8 min read RCE | Writeup detailing CVE-2026-47483, a denial-of-service and information disclosure vulnerability in NVIDIA DCGM Exporter. This flaw allows unauthenticated attackers to exhaust exporter resources, crashing monitoring services and blinding operators to GPU health. Research uncovered over 2,000 exposed GPU servers on the internet, revealing substantial NVIDIA hardware including Blackwell, H200, and H100 models, utilized by various organizations such as neoclouds, consumer GPU farms, and research institutes. |
| 2026-10-09 2026 | A Single POST Freezes Any Next.js Server news 4 min read RCE | Writeup of CVE-2026-23870, a denial-of-service vulnerability in React Server Components, allows an attacker to freeze any Next.js server with a single POST request. The vulnerability arises from inefficient parsing of nested `FormData` with numerous `$K` pointers, causing excessive CPU usage that blocks Node.js's single event loop thread. This issue affects React versions 19.0 to 19.2.6 across `react-server-dom-webpack`, `react-server-dom-turbopack`, and `react-server-dom-parcel` packages, and was patched in React 19.0.6, 19.1.7, and 19.2.6. |
| 2026-10-07 2026 | Bitvulnex: a vulnerable crypto exchange beginner 9 min read | Library for practicing application security, Bitvulnex is a deliberately vulnerable Bitcoin exchange. It features 40 planted vulnerabilities spanning web security, exchange business logic, Bitcoin workflows, and infrastructure, allowing users to explore and learn from common issues like access control failures, injection, race conditions in withdrawals, price oracle manipulation, and SSRF in KYC processes. The application, built with Next.js, PostgreSQL, and Redis, includes simulated trading, deposits, and background jobs to provide a realistic environment for discovering and understanding security flaws. |
| 2026-10-06 2026 | The evolution of Bug Bounty: history, best practices and the impact of AI beginner | Bug bounty programs have transformed from informal hacker challenges to sophisticated security initiatives. Their evolution is marked by increasing organization, structured rewards, and broader adoption by companies seeking to proactively identify vulnerabilities. Key best practices include clear scope definition, fair compensation, and prompt communication. The emergence of AI is set to significantly impact bug bounties by automating vulnerability discovery and analysis, potentially leading to more efficient programs and a surge in reported bugs. → yeswehack.com |
| 2026-10-02 2026 | Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research news 13 min read AI | Library for triaging CVEs, emphasizing the impact of AI-assisted research on vulnerability disclosure volume. It highlights that many AI-discovered bugs, like those in Nginx (e.g., nginx-rift, nginx-poolslip, nginx-quicburst, CVE-2026-42533), require uncommon or non-default configurations, significantly reducing their real-world exploitation potential compared to their critical CVSS scores. The library provides a framework for identifying vulnerabilities likely to be mass-exploited by assessing their commonality in enterprise environments, impact, in-the-wild exploitation, public proof-of-concept availability, and reliance on default configurations. → bishopfox.com |
| 2026-09-26 2026 | ‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter beginner | Rabhi, the #1 bug bounty hunter, clarifies that their success isn't solely due to automation. They emphasize that they only automate the reconnaissance phase of bug hunting. This strategic focus allows them to efficiently gather information, which is crucial for identifying vulnerabilities. By automating this initial step, Rabhi can dedicate more time and effort to manual testing and in-depth analysis, leading to their top ranking in bug bounty hunting. → yeswehack.com |
| 2026-09-24 2026 | Your Vulnerability Backlog Is No Longer Technical Debt, It’s an Attack Surface beginner 5 min read | Library for analyzing application security vulnerability backlogs, reframing them as attack surfaces rather than technical debt. It highlights how increased code velocity, agentic development, and automated attacker reconnaissance have fundamentally shifted the risk landscape. The library emphasizes re-evaluating accepted vulnerabilities, understanding how low-severity findings can combine into high-severity attack paths, and shifting focus from prioritization to fix correctness and clearing rates to effectively reduce the backlog. → snyk.io |
| 2026-09-24 2026 | How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually intermediate | This content guides bug bounty hunters on using Gemini CLI for research. It focuses on leveraging the tool to analyze evidence and perform manual validation, suggesting Gemini CLI as a method for streamlining these crucial steps in bug bounty hunting. The summary highlights the practical application of Gemini CLI for security researchers in identifying and verifying vulnerabilities. → yeswehack.com |
| 2026-09-18 2026 | Jason Haddix: Stop fearing AI pentesting beginner 7 min read AI | Library for AI-driven penetration testing, informed by Jason Haddix's insights. This resource details how AI will automate 90% of pentests, addressing scale limitations in manual testing and the rapid deployment of AI-generated code. It highlights that AI pentesting, while eclipsing basic scanners and checkbox tests, requires human methodology, such as recon processes and whitebox testing, to be effective. Independent benchmarks, like Doyensec's evaluation of Aikido AI Pentesting, demonstrate its capability in uncovering vulnerabilities, including logic flaws and broken access controls often missed by manual methods. → aikido.dev |
| 2026-09-15 2026 | ‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting beginner | Bug bounty hunter krevetk0 prioritizes targets that offer societal value, demonstrating a principled approach to his work. This focus guides his selection of vulnerabilities to discover and report. → yeswehack.com |
| 2026-09-09 2026 | The Best Claude Code Setup for Bug Bounty Hunting intermediate AI | This article outlines how to transform Claude Code into a potent bug bounty hunting tool. By utilizing MCP (a custom setup), agents, tools, and automated security workflows, hunters can enhance their efficiency. The focus is on creating a tailored environment within Claude Code to streamline bug bounty activities. → infosecwriteups.com |
| 2026-09-04 2026 | How to use Codex for Bug Bounty research: explore broadly, validate rigorously intermediate | This content advises bug bounty hunters to leverage Codex for broad exploration of potential vulnerabilities. It emphasizes a two-pronged approach: initially, use Codex to cast a wide net, discovering various attack vectors and potential issues. Subsequently, the crucial second step is rigorous validation. This means meticulously verifying any findings generated by Codex to ensure they are genuine, exploitable, and not false positives. The focus is on using AI as a powerful research tool, but with a strong emphasis on human oversight and validation to confirm real-world security risks. → yeswehack.com |
| 2026-09-04 2026 | I Hacked into my University’s Vending Machine And it was soo BAD! intermediate | A hacker claims to have gained unauthorized access to their university's (MIT-BLR) J Vend vending machine. While not sharing the exploit method or app, the hacker intends to provide hints for others to replicate the hack. They state the process took a few weeks of effort. → infosecwriteups.com |
| 2026-09-04 2026 | How an Integer Overflow Vulnerability Let Me Buy Anything for ₹0 beginner | A security researcher discovered an integer overflow vulnerability on an e-commerce platform, allowing them to purchase items for ₹0. By manipulating the quantity input field, they bypassed the platform's pricing calculations. This flaw stemmed from the way the system handled 32-bit signed integers. The researcher details the vulnerability's mechanics, its root cause, and provides prevention strategies for developers to avoid similar issues. → infosecwriteups.com |
| 2026-09-04 2026 | How I Turned Self-XSS into Reflected XSS (and Bypassed the WAF) intermediate XSS | A security researcher found a Self-XSS vulnerability on an e-commerce platform during a Bugcrowd bug bounty hunt. By chaining this with CSRF, they successfully transformed it into a Reflected XSS, also bypassing the Web Application Firewall (WAF). The write-up details this process for educational purposes. → infosecwriteups.com |
| 2026-09-03 2026 | Reconnaissance Overview - Bug Bounty Masterclass beginner 2 min read Recon | Video walkthrough of bug bounty reconnaissance, detailing a repeatable process for discovering a target's full attack surface. It covers terminology and a step-by-step methodology beginning with passive DNS discovery using tools like `subfinder`, then moving to active subdomain enumeration and public exposure probing. The content aims to equip viewers with the ability to generate a comprehensive list of live, publicly accessible assets from a single company name, ready for vulnerability testing, and mentions AI agents like Claude Code as an assist. → wiz.io |
| 2026-09-02 2026 | ‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty news | Crédit Agricole Personal Finance & Mobility emphasizes the crucial role of "humans in the loop" within their bug bounty program. This human element, comprised of ethical hackers, is vital for identifying vulnerabilities that automated systems might miss. By integrating these skilled individuals, the company strengthens its cybersecurity posture, proactively addressing potential threats and enhancing the overall security of its digital services. The program allows for continuous improvement through diverse perspectives and hands-on testing. → yeswehack.com |
| 2026-08-31 2026 | Anatomy of a ServiceNow Red Team intermediate | This content details the inner workings and strategies of a ServiceNow Red Team. It explores the methodologies and objectives employed by these security assessment teams to identify vulnerabilities within ServiceNow environments. The focus is on understanding how red teams simulate real-world attacks to test an organization's defenses, uncover weaknesses, and provide actionable recommendations for improvement. The article aims to demystify the process and highlight the value of red teaming for enhancing ServiceNow security posture. |
| 2026-08-31 2026 | When a Single Text File Breaks a Trust Boundary (Bug Bounty writeup) intermediate | A security researcher discovered a critical vulnerability in an open-source tool that allowed users to specify the application's working directory within a subdirectory of a larger repository. This feature, seemingly innocuous, could be exploited via a single text file to redefine the application's perceived working directory, breaking a trust boundary and potentially leading to unauthorized access or execution. The writeup details the discovery and tracing of this bug, highlighting the unexpected impact of a simple configuration option. → infosecwriteups.com |
| 2026-08-31 2026 | I Made Claude Believe I Was an Anthropic-Verified Researcher. news AI | A security researcher discovered a jailbreak for Claude Sonnet 4.6 by convincing the AI it was an Anthropic-verified researcher. This allowed the researcher to develop attack tools against Claude. The researcher attempted responsible disclosure, but Anthropic remained silent for 57 days. A technical write-up, payloads, and proof-of-concept are available on GitHub. The exploit began as a test of how Claude processed XML-style tags. → infosecwriteups.com |
| 2026-08-31 2026 | He Sent 200,000 Reset Codes to Instagram in 10 Minutes. Instagram Paid Him $30,000. news AuthN | A security researcher exploited a vulnerability by sending 200,000 password reset codes to Instagram within 10 minutes. This action highlighted a flaw in their system, and Instagram subsequently awarded the researcher a $30,000 bounty for discovering and reporting the issue. The researcher has incorporated this bug into their platform, HackThrough, which offers interactive challenges based on real bug bounty write-ups. → infosecwriteups.com |
| 2026-08-30 2026 | How I Got My Highest Payout intermediate AuthZ | The author discovered a vulnerability in an application portal where a lengthy, hour-long registration form prevented thorough testing. This extensive form, collecting sensitive personal and household data, was likely neglected by other researchers due to its tedious nature. This allowed the bug to persist unnoticed. The author's highest payout was a result of exploiting this overlooked vulnerability stemming from the form's length. → infosecwriteups.com |
| 2026-08-29 2026 | Just the rumour of a bug is enough to find an exploit these days advanced 8 min read | Library for OCaml's cohttp addressing a path traversal vulnerability. The entry highlights how modern AI agents, like DeepSeek V4 Pro, can rapidly generate exploits from minimal information, predating public patches. It emphasizes the ineffectiveness of traditional security embargoes due to AI's ability to find vulnerabilities by "rumor" and suggests a shift towards continuous, rapid patching and improved distribution mechanisms for open-source projects. |
| 2026-08-25 2026 | When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS) beginner 9 min read Recon | Interview with Ryan Bonner (Roll4CombatUS) details his journey into bug bounty hunting, emphasizing the importance of overcoming fear and consistent effort. Bonner highlights favorite techniques like recon and SSRF, and mentions tools such as Gungnir. He advocates for clear communication from programs to researchers and advises new hunters to build strong habits and invest dedicated time in targets, rather than solely focusing on bug-finding goals. → intigriti.com |
| 2026-08-25 2026 | When fear no longer holds you back. Interview with Ryan Bonner (Roll4CombatUS) beginner 9 min read Recon | Interview with Bug Bounty hunter Ryan Bonner (Roll4CombatUS) detailing his journey, favorite tools like Gungnir, and preferred hunting grounds. Bonner emphasizes the importance of recon, asset ownership verification, and his passion for finding SSRF vulnerabilities. He shares advice for aspiring hunters, stressing consistency, continuous learning through reading write-ups, and managing fear. Bonner also touches upon the evolving landscape with AI, positioning it as an assistant rather than a replacement for critical thinking in bug hunting. → intigriti.com |
| 2026-08-18 2026 | Introducing the Solana Mobile Vulnerability Disclosure Policy Bug Bounty Program and Security Grants beginner 2 min read | Program outlining responsible security research for Solana Mobile products, including a bug bounty with tiers and rewards paid in SKR. In-scope components include Seed Vault, SKR onchain programs, and the Seeker Genesis Token backend. Researchers must follow strict reporting guidelines, use local test validators, and avoid public disclosure. Security grants are also available for work improving the ecosystem's security. |
| 2026-08-15 2026 | Rise of the robo-bounty hunters: Prepare for AI-enabled vulnerability disclosures beginner 3 min read | Library for managing AI-enabled vulnerability disclosures, addressing the surge in reports from individuals using AI tools for security research. It advises companies to update existing bug bounty programs or implement new ones to handle increased volume, varied quality of submissions, and the potential for both consequential vulnerabilities and unprofessional conduct. Key recommendations include establishing clear contact channels, defining permitted research, setting response expectations, determining financial posture to prevent extortion, developing internal triage protocols, and anticipating research volume for effective filtering. |
| 2026-08-15 2026 | Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym news 9 min read AI | Library for autonomous AI vulnerability research, Atlas, developed by Wiz, ranks #1 on the CyberGym benchmark with a 90.9% success rate and has uncovered over 200 previously unknown vulnerabilities in open-source projects like grpc, dnsmasq, and Kubernetes. Atlas utilizes specialized AI agents to map attack surfaces, hunt in parallel, adversarially validate findings, and prove exploits by triggering them dynamically, moving beyond model-generated suspicion to reproducible proof of security issues, including a critical RCE in GitHub (CVE-2026-3854). → wiz.io |
| 2026-08-11 2026 | Bypassing Enterprise SSO via a Forgotten Source Map: A Bug Bounty Story intermediate AuthN | This bug bounty story details a researcher's process of finding a vulnerability in an enterprise Single Sign-On (SSO) system. Despite a large scope, the researcher discovered a forgotten source map file. This map inadvertently exposed sensitive information, allowing them to bypass the SSO authentication mechanism. → infosecwriteups.com |
| 2026-08-11 2026 | The Bug That Almost Wasn’t: How a “Dead End” Led to 500+ Leaked Customer Records intermediate | A security researcher discovered a critical vulnerability after investigating a seemingly "dead end" in a website's custom post types. This persistence allowed them to uncover an issue that exposed over 500 customer records. The story highlights the importance of thorough investigation and not dismissing potential avenues, even when they appear unpromising. → infosecwriteups.com |
| 2026-08-02 2026 | frontier class vulnerabilities: it gets worse before it (maybe) gets better advanced 5 min read | Writeup on "frontier class vulnerabilities" discusses how advanced AI models like GPT 5.6 Sol are significantly accelerating vulnerability discovery, exemplified by the pre-authentication RCE in WordPress known as wp2shell. The author, from Assetnote/Searchlight Cyber, shares insights on AI's impact on offensive security research, noting that while current AI requires human guidance for complex tasks, models are progressing rapidly. This capability shift raises questions about practitioners' responsibilities and the potential for both increased attack sophistication and, possibly, higher baseline security standards for new software. |
| 2026-08-01 2026 | Intigriti Bug Bytes #238 - July 2026 🚀 news 10 min read Burp RCE Secrets | Tool, P4RS3LT0NGV3, assists LLM red teaming by automatically transforming prompts with obfuscation and encoding techniques to test adversarial input handling. This collection of Intigriti Bug Bytes also covers AI poisoning attacks on RAG systems, the importance of reconnaissance context in the AI era, the risks of AI assistants introducing data exposure, and RCE vulnerabilities in GitHub.com and GitHub Enterprise Server. Additionally, it features a guide on bypassing Content Security Policy and a bug bounty starter kit for new researchers. → intigriti.com |
| 2026-07-31 2026 | How to appeal a bug bounty submission beginner 9 min read | Library for appealing bug bounty submissions, offering a mediation process for reports that are incorrectly closed, downgraded in severity, or left unresolved. It guides researchers on how to initiate appeals, provides common scenarios like incorrect triage or severity assessment, and emphasizes professionalism and avoiding unauthorized disclosures. The library details the steps for requesting support through Intigriti's platform, including utilizing the "Request support" button and commenting on reports within specific timeframes to ensure fair resolution. → intigriti.com |
| 2026-07-30 2026 | Account Takeover Across Multiple Programs via Featurebase Integration intermediate 2 min read AuthZ IDOR | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability leading to Account Takeover (ATO) on Featurebase, a feedback and feature request platform. The vulnerability arises from Featurebase trusting client-controlled `userId` attributes without proper validation, allowing attackers to impersonate other users. Exploitation involves modifying the `userId` during API calls or account modification to gain access tokens and subsequently take over accounts via email change or settings modification functionalities. → infosecwriteups.com |