Nothing here yet.
Nothing here yet.
Apr 8, 2025 · 2 min read · In the world of user authentication, ensuring that email addresses are properly validated and managed is crucial. But what happens when an attacker can abuse a third-party authentication system to "reserve" someone else's email, effectively blocking ...
Join discussionMar 31, 2025 · 3 min read · Introduction Sometimes, the most interesting vulnerabilities aren’t the flashy ones — they’re the sneaky, almost accidental bugs that show just how broken the logic behind a system can be. This is one such story where a "simple" password change page ...
Join discussionMar 31, 2025 · 1 min read · The Bug I found a weird issue with the platform’s account deletion flow: When a user deletes their account, their added email addresses were not removed from the system. If the user tried to sign up again using the same email, they couldn’t — the s...
Join discussionMar 31, 2025 · 1 min read · The Bug Found a critical account takeover in a web application’s registration flow.The platform allowed creating the same account (same email) from a different session, even though the account already existed. Step-by-Step PoC Create account with em...
Join discussionMay 3, 2023 · 1 min read · The app can be launched by any other app because its deeplink activity is exported=true. Adb exploit adb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk Exploi...
Join discussion