DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK

Dec 7, 2025 · 9 min read · It was just another bug hunting session on a public program. The scope wasn't huge - only a couple of domains to work with - but that's often where you find the best bugs. I had been grinding on this program for about 8 hours total, with roughly 6 of...