appsec.fyi · Sources

hackerone.com

33 curated AppSec resources from hackerone.com across 12 topics on appsec.fyi.

hackerone.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-04-22.

SSRF 7 JWT 6 AuthN 5 IDOR 4 GraphQL 2 SSTI 2 XSS 2 AI 1 AuthZ 1 Bug Bounty 1 CSRF 1 XXE 1
Date Added Resource Excerpt
2026-04-22 2026HackerOne: LLM01: Invisible Prompt InjectionAIProgram: HackerOne Severity: medium Weakness: LLM01: Prompt Injection ## Description Hey team, Hai is vulnerable to invisible prompt injection via Unicode tag characters. ## Reproduction steps 1. ...
2026-04-22 2026Internet Bug Bounty: Argo CD CSRF leads to Kubernetes cluster compromiseCSRFProgram: Internet Bug Bounty Severity: high Weakness: Cross-Site Request Forgery (CSRF) GHSA: https://github.com/argoproj/argo-cd/security/advisories/GHSA-92mw-q256-5vwg It's been publicly known for...
2026-04-19 2026Bykea: IDOR on In-App Hardcoded Zombie — HackerOneIDORBykea: IDOR on In-App Hardcoded Zombie — HackerOne
2026-04-19 2026IDOR Vulnerability — HackerOne Report 2633771IDORIDOR Vulnerability — HackerOne Report 2633771
2026-04-17 2026HackerOne #1210502: Jitsi Authentication Bypass (JWT)JWTHackerOne #1210502: Jitsi Authentication Bypass (JWT)
2026-04-17 2026HackerOne #2472798: Newspack Extended Access JWT bypassJWTHackerOne #2472798: Newspack Extended Access JWT bypass
2026-04-17 2026How an IDOR Vulnerability Led to User Profile Modification (HackerOne)IDORWriteup detailing an Insecure Direct Object Reference (IDOR) vulnerability found on mtnmobad.mtnbusiness.com.ng, which allowed remote users to modify account information including phone numbers. The vulnerability arose from the improper validation of account identifiers and exposed user data in HTTP requests and responses. The report highlights how easily identifiable parameters, such as short numerical IDs and email addresses, can be exploited by attackers using automated tools for unauthorized access and account takeover, emphasizing the need for robust access controls and cryptographically strong identifiers.
2026-04-17 2026HackerOne Report #435066: SQL injection in GraphQL endpointGraphQLHackerOne Report #435066: SQL injection in GraphQL endpoint
2026-04-17 2026HackerOne Report #812064: SAML authentication bypass (Rocket.Chat)AuthNHackerOne Report #812064: SAML authentication bypass (Rocket.Chat)
2026-04-17 2026HackerOne Report #209008: Authentication Bypass - AutomatticAuthNHackerOne Report #209008: Authentication Bypass - Automattic
2026-04-17 2026HackerOne Report #423541: H1514 Server Side Template InjectionSSTIHackerOne Report #423541: H1514 Server Side Template Injection
2026-04-11 2026HackerOne #164224: SSTISSTIHackerOne #164224: SSTI
2026-04-11 2026HackerOne: Trint insecure client-side JWT generationJWTHackerOne: Trint insecure client-side JWT generation
2026-04-11 2026HackerOne: Linktree account takeover via improper JWT validationJWTHackerOne: Linktree account takeover via improper JWT validation
2026-04-11 2026HackerOne: Critical vulnerability in JWE SpecificationJWTHackerOne: Critical vulnerability in JWE Specification
2026-04-11 2026HackerOne: Argo CD JWT audience claim not verifiedJWTHackerOne: Argo CD JWT audience claim not verified
2026-04-11 2026Remitly: 0-Click Account Takeover (HackerOne)AuthNRemitly: 0-Click Account Takeover (HackerOne)
2026-04-10 2026Semrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940AuthNSemrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940
2026-04-10 2026Slack OAuth2 redirect_uri bypass — HackerOne #2575AuthNSlack OAuth2 redirect_uri bypass — HackerOne #2575
2026-04-10 2026HackerOne: SSRF in Exchange Leads to ROOT (Shopify)SSRFHackerOne: SSRF in Exchange Leads to ROOT (Shopify)
2026-04-10 2026HackerOne: SSRF Mitigation Bypass Using DNS Rebind AttackSSRFHackerOne: SSRF Mitigation Bypass Using DNS Rebind Attack
2026-04-10 2026HackerOne: SSRF in Search.gov via URL ParameterSSRFHackerOne: SSRF in Search.gov via URL Parameter
2026-04-10 2026HackerOne: SSRF via Analytics ReportsSSRFHackerOne: SSRF via Analytics Reports
2026-04-10 2026HackerOne Report: IDOR Allows ViewingIDORHackerOne Report: IDOR Allows Viewing
2026-04-10 2026XXE Complete Guide: Impact, Examples, and PreventionXXEReference detailing XML External Entity (XXE) vulnerabilities, their impact including denial of service, data exposure, and server-side request forgery (SSRF), and mitigation strategies like using Web Application Firewalls (WAFs) and application server instrumentation. It provides examples of resource exhaustion, data extraction using `file://` URIs, SSRF attacks targeting internal systems, and blind XXE for out-of-band data exfiltration.
2026-04-10 2026How a GraphQL Bug Resulted in Authentication BypassGraphQLLibrary detailing an authentication bypass vulnerability in an e-commerce application's GraphQL API. The article explores how attackers can abuse GraphQL introspection and mutations, such as `Register` and `CreateAdminUser`, to gain unauthorized administrative access. It highlights the importance of proper access control for GraphQL endpoints and discusses techniques for discovering these flaws, including schema introspection and authorization checks, as explained by researcher J. Francisco Bolivar.
2026-04-10 2026How to Find XSS Vulnerabilities: Practical Security GuideXSSLibrary detailing Cross-Site Scripting (XSS) vulnerabilities, covering reflected, stored, and DOM-based types. It provides practical techniques for manual and automated discovery, recommending tools like Dalfox, XSStrike, and xsshunter, alongside payload resources such as PayloadsAllTheThings and HackTricks. Specific examples include blind XSS in admin dashboards and stored XSS in GitLab wikis, emphasizing the use of polyglots and callback platforms for effective exploitation.
2026-04-06 2026HackerOne HacktivityBug BountyHackerOne Hacktivity
2026-04-03 2026How a Cross-Site Scripting Vulnerability Led to Account Takeover | HackerOneXSSWriteup detailing how a reflected XSS vulnerability on yelp.com, stemming from unescaped cookie values and a cookie parsing issue, enabled account takeovers. The vulnerability allowed for persistent XSS payloads, simulated credential theft via a keylogger, and facilitated linking external accounts. Remediation involved validating and sanitizing user input, and removing the ability to set cookies via query parameters.
2026-04-03 2026How To Find Broken Access Control Vulnerabilities in the Wild | HackerOneAuthZGuide to finding Broken Access Control (BAC) vulnerabilities, explaining concepts like Insecure Direct Object Reference (IDOR) and covering identifier types such as numeric, user-chosen, natural keys, composite keys, UUIDs, and hashes. It details the permissions mapping technique for identifying BAC flaws by creating lists of user roles and application actions, and highlights the prevalence of BAC bugs as the OWASP Top 1 vulnerability.
2025-08-14 2025SSRF in https://couriers.indrive.com/api/file-storageSSRFProgram: inDrive Severity: high Weakness: Server-Side Request Forgery (SSRF) ## Summary: SSRF in ` url ` parameter in https://couriers.indrive.com/api/file-storage ## Steps To Reproduce: I will tr...
2025-08-14 2025Full Read SSRF on Gitlab's Internal GrafanaSSRFProgram: GitLab Severity: critical Weakness: Server-Side Request Forgery (SSRF) Apparently, Grafana is bundled with Gitlab by default. So the grafana instance that is accessible via `/-/grafana/`is v...
2023-02-14 2023How To: Server-Side Request Forgery (SSRF)SSRFGuide to Server-Side Request Forgery (SSRF) vulnerabilities, detailing how attackers can control server-initiated requests. The entry explains the impact of SSRF, testing methodologies using tools like netcat, and techniques to bypass common mitigations such as IP blacklisting and whitelisting, including exploiting HTTP redirects and DNS records. It highlights common attack vectors like webhooks and PDF generators.