launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API
HackerOneBasecamp2026-10-30
Web, API
High
BUG BOUNTY WRITEUPS
Authentication bypass writeups
Getting in without valid credentials. Response manipulation, broken session handling, SSO and SAML mistakes, and missing checks on sensitive endpoints.
171 reports and writeups from 2024 to 2026. 113 carry a severity from the disclosing platform, 47 of them rated High or Critical. Last updated 2026-10-30.
Latest Authentication bypass reports
Search and filter all writeupsWeb, API
Not rated
Cross-account webhook takeover: PUT and DELETE on / /webhooks/ .json reach another account's webhook
HackerOneBasecamp2026-10-30
Web
High
CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content
HackerOneWordPress2026-10-30
Web
Medium
Web
Not rated
Windows SSPI connection-pool probe can reuse a connection under the wrong user
HackerOnecurl2026-10-26
Windows
Medium
CVE-2026-115529: Schannel TLS auto client session resumption
HackerOnecurl2026-10-26
Web
Low
A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable
HackerOneMozilla2026-10-26$4,000 bounty
Web, API
High
Security Write-Up: Authentication Bypass via Response Manipulation on Email Change Feature
Medium2026-10-22
Web
Not rated
Cross-room signaling injection enabling unauthorized force-mute
HackerOneNextcloud2026-10-21
Web, Cloud
Low
CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
HackerOnecurl2026-10-20
Web
Medium
SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
HackerOnecurl2026-10-19
Web
Low
curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line
HackerOnecurl2026-10-19
Web
High
Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect
HackerOneAWS VDP2026-10-16
Web, Cloud
Medium
CVE-2026-87861: cross-origin reuse of a Negotiate connection
HackerOnecurl2026-10-14
Web
Low
Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data
HackerOneEssity2026-10-14
Web
Medium
CVE-2026-86411: FTP connection reuse inherits client-certificate
HackerOnecurl2026-10-14
Web
Not rated
Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain Compromised
HackerOneR32026-10-08
Web, Source Code
Critical
Cross-User Lock/Unlock via Absolute DAV Path
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION
HackerOnecurl2026-09-14
Web
Medium
11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first
HackerOnecurl2026-09-07
Web
Not rated
ACL cache collision lets a role inherit privileges from a same-named socket user
HackerOneMariaDB2026-09-07
Web
Medium
Activity app does not verify federated file activity received from remote servers
HackerOneNextcloud2026-09-05$150 bounty
Web, Cloud
Low
CVE-2026-13608: OpenLDAP SASL authentication bypass
HackerOnecurl2026-09-03
Web
Low
CVE-2026-19931: Negotiate ambient user conn reuse
HackerOnecurl2026-09-03
Web
Medium
Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions
HackerOneMonero2026-08-17
Web3
High
Wallet RPC Restricted-Mode Policy Bypass
HackerOneMonero2026-08-17
Web3
High
Windows SSPI connection-pool probe can reuse a connection under the wrong user
HackerOnecurl2026-08-14
Windows
Medium
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
HackerOneNode.js2026-07-29
Web
Medium
Authentication Bypass via XML Signature Wrapping in SAML SSO
HackerOneRocket.Chat2026-07-27
Web
Critical
AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF
HackerOneAWS VDP2026-07-22
Web, Cloud
High
ssh_config_matches is dead code: unauthorized SSH key reuse
HackerOnecurl2026-06-30
Web
Medium
Unauthenticated File Upload with CORS Wildcard and No Rate Limiting on ████████ and ████████
HackerOneEssity2026-06-29
Web
High
Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
HackerOneNode.js2026-06-25
Web
High
CVE-2026-8927: env-set cross-proxy Digest auth state leak
HackerOnecurl2026-06-24
Web
Medium
CVE-2026-8458: wrong reuse for different services
HackerOnecurl2026-06-24
Web
Low
Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column
HackerOneMozilla2026-06-23$2,000 bounty
Web
Medium
Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file
HackerOneRocket.Chat2026-06-16
Web
High
Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)
Researcher blog2026-06-12
Web
Not rated
Trailing-Dot Hostname in Redirect Silently Strips Client Certificate and Auth Credentials
HackerOnecurl2026-06-10
Web
Medium
SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removal
HackerOnecurl2026-06-09
Web
High
SOCKS5 no-auth accepted despite username/password-only authentication
HackerOnecurl2026-06-09
Web
Medium
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
HackerOneNextcloud2026-06-07$2,500 bounty
Web, Cloud
High
PIN bypass in PassCodeActivity via back button
HackerOneNextcloud2026-06-07$150 bounty
Web, Cloud
Medium
CURLOPT_COOKIE leaked to cross-origin redirect target — CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path
HackerOnecurl2026-06-05
Web
Medium
Session ID reuse allowing XML‑RPC API authentication bypass
HackerOneRevive Adserver2026-06-03
Web, API
Medium
iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private Tabs
HackerOneBrave Software2026-05-28
iOS
Medium
Unauthenticated Account Registration + Email Verification Bypass + PII Data Leak (2,480 Records) on ████████
HackerOneEssity2026-05-27
Web
Medium
POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
HackerOneCoinMate.io2026-05-20
API, Web3
Medium
CVE-2026-5545: wrong reuse of HTTP Negotiate connection
HackerOnecurl2026-04-29
Web
Medium
The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)
Researcher blog2026-04-29
Web
Not rated
Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY
HackerOnecurl2026-04-29
Web
Medium
Negotiate Authentication Premature on Connection Reuse
HackerOnecurl2026-04-29
Web
High
Complete authentication bypass to admin permissions
HackerOneRocket.Chat2026-04-22
Web
Critical
lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)
HackerOnecurl2026-04-16
Web
Medium
Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoning
HackerOnecurl2026-04-03
Web
High
HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reuse
HackerOnecurl2026-03-31
Web
Not rated
Connection Reuse Ignores OAuth Bearer Token Mismatch
HackerOnecurl2026-03-10
Web
Medium
libcurl: Improper Authentication State Management on Cross-Protocol Redirects
HackerOnecurl2026-01-17
Web
Low
Improper Authentication Allows Making Requests as Other Users
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
2FA Bypass via Response Manipulation on Login Page
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
The Fragile Lock: Novel Bypasses For SAML Authentication
PortSwigger Research2025-12-10
Web
Not rated
Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507)
HackerOneNextcloud2025-12-05
Web, Cloud
Low
Unauthenticated GraphQL access by prepending __schema to private operations
HackerOneEnjin2025-12-05$500 bounty
Web, API
Medium
Approval app allows users to request approval for other users file
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Username Validation Bypass
HackerOneRevive Adserver2025-11-26
Web
Medium
Improper bot-authentication allows to impersonate any user when sending messages in a room
HackerOneBasecamp2025-11-21$2,000 bounty
Web
High
Authentication Bypass in Subscription Management Endpoint
HackerOnelemlist2025-11-17
Web, API
Critical
2FA bypass possible on https://authsvc.singlestore.com
HackerOneSingleStore2025-10-22
Web
Medium
Account Takeover in Password Reset Function
HackerOneMars2025-09-02
Web
Critical
Incorrect Parsing of IPv6 Zone ID in curl
HackerOnecurl2025-09-01
Web
High
AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs
HackerOneAWS VDP2025-08-25
Web, Cloud
Low
Email Verification Bypass via Race Condition
HackerOneMalwarebytes2025-08-15
Web
Not rated
total Failure of password protection while extracting seed phrase! increases attack surface area for scammers
HackerOneMetaMask2025-07-31$3,500 bounty
Web
Medium
Mint Oauth2 access token for targeted user
HackerOneGitLab2025-07-23$5,580 bounty
Web
High
Speculative Execution Side-Channel in `curl`
HackerOnecurl2025-07-01
Web
Medium
Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts
HackerOneLichess2025-06-13
Web
Medium
returnUrl= allow attacker to redirect users to the another phising website and takeover credientials
HackerOneInsightly2025-06-04
Web
Medium
TLS client authentication can be bypassed due to ticket resumption
HackerOneInternet Bug Bounty2025-05-27$2,162 bounty
Web
Medium
Any WARP User Can Access Organization-Specific Application
HackerOneCloudflare Public Bug Bounty2025-05-19
Web, Cloud
Not rated
Middleware Authentication Bypass on IBM Portal
HackerOneIBM2025-05-02
Web
Critical
Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed Logins
HackerOneWakaTime2025-05-01
Web
High
Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)
Researcher blog2025-03-24
Web
Not rated
2FA Bypass leads to impersonation of legimate users
HackerOneDrugs.com2025-03-14
Web
High
Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)
HackerOneMTN Group2025-03-04
Web
Critical
Improper Authentication Allows Making Appeals as Other Users
HackerOneU.S. Dept Of Defense2025-02-12
Web
Medium
Yet Another OTP code Leaked in the API Response
HackerOneMTN Group2025-01-08
Web, API
Critical
Unauthorized Access Exposing Sensitive Data
HackerOneU.S. Dept Of Defense2024-12-18
Web
High
Forced OAuth authorization using button ID in hash and holding space
HackerOneLinkedIn2024-12-17
Web
Medium
IBM OpenPages vulnerable to exposure of sensitive information
HackerOneIBM2024-10-01
Web
Medium
Vulnerabilities in Open Source C2 Frameworks
Researcher blogBishop Fox (Sliver), Havoc, Ninja C22024-09-18
Web
Not rated
Authentication Bypass Leads To Complete Account TakeveOver on ██████████
HackerOneMTN Group2024-09-14
Web
Critical
From MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms
Researcher blogJupyter, Hugging Face, MLflow2024-08-20
Web, AI
Not rated
The Hunt for ALBeast: A Technical Walkthrough
Researcher blogAWS2024-08-20
Web, Cloud
Not rated
How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System
Researcher blogHoneywell2024-08-19
Web, API
Not rated
$1600 Bounty on a Main Domain
Medium2024-08-18$1,600 bounty
Web
Not rated
Breaking the Barrier: Admin Panel Takeover Worth $3500
Medium2024-08-13$3,500 bounty
Web
Not rated
Authentication Bypass in login-token Authentication Method
HackerOneRocket.Chat2024-08-10
Web
Critical
Registration bypass with leaked Invite Token
HackerOneRocket.Chat2024-08-10
Web
High
Bypassing 2FA with conventional session management - open.rocket.chat
HackerOneRocket.Chat2024-08-10
Web
Low
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Researcher blogApache HTTP Server, ModSecurity, Redmine2024-08-09
Web
Not rated
The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover
Researcher blog2024-08-07
Web, API
Not rated
How I Got Critical P2 Bug on Google VRP
MediumGoogle2024-08-04
Web
Not rated
Account Takeover via Broken Authentication Workflow: Free Lifetime Streaming!
Researcher blog2024-08-01
Web
Not rated
SAML Authentication Bypass Leading to Admin Panel Access
Medium2024-08-01
Web
Not rated
Plug Security Holes in React Apps That Can Lead to API Exploitation
Researcher blogSiemens2024-07-31
Web, API
Not rated
ElasticSearch Smash & Grab
Medium2024-07-26
Web
Not rated
Exploiting Broken Authentication Control In GraphQL
Researcher blog2024-07-24
Web, API, Cloud
Not rated
Restrict any user from Login to their account
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
Authentication bypass and potential RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentials
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
Authentication Bypass on https://███████/
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
Breaking Down Barriers: Exploiting Authenticated IPC Clients
Researcher blog2024-07-18
Web
Not rated
SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts
Researcher blogSAP2024-07-17
Web, Cloud, AI
Not rated
Ability to by-pass second factor
HackerOneNextcloud2024-07-14$1,000 bounty
Web, Cloud
Medium
Account Takeover via Authentication Bypass in TikTok Account Recovery
HackerOneTikTok2024-07-13$12,000 bounty
Web
Critical
TOTP Authenticator implementation Accepts Expired Codes
HackerOneHackerOne2024-07-11
Web
High
Two-factor authentication bypass lead to information disclosure about the program and all hackers participate
HackerOneHackerOne2024-07-11
Web
High
Improper Authentication - 2FA OTP Reusable
HackerOneHackerOne2024-07-11
Web
High
2FA Bypass via Leaked Cookies
HackerOneHackerOne2024-07-11
Web
Medium
Two factor authentication bypass
HackerOneHackerOne2024-07-11
Web
Medium
Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery
HackerOneHackerOne2024-07-11
Web
Critical
Dynamics 365 Business Central - A Journey With Ups and Downs
GitHubMicrosoft2024-07-10
Web
Not rated
Authentication & Registration Bypass in Newspack Extended Access
HackerOneAutomattic2024-07-05
Web
Medium
How I Discovered Authentication Bypass That Blocks Users from Accessing the Website ?
Medium2024-07-04
Web
Not rated
Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification
HackerOneTikTok2024-07-03
Web
Low
Getting Unauthenticated Remote Code Execution On The Logsign Unified Secops Platform
Researcher blogLogsign2024-07-01
Web, Source Code
Not rated
17 vulnerabilities in Sharp Multi-Function Printers
GitHubSharp, Toshiba2024-06-27
API, Binary
Not rated
Looking for vulnerabilities in Strapi (CVE-2024-34065)
Researcher blogStrapi2024-06-25
Web, Source Code
Not rated
Account deletion using the /v1/account/destroy API endpoint using account password without 2FA verification
HackerOneMozilla2024-06-17$1,000 bounty
Web, API
Medium
Email OTP/2FA Bypass
HackerOneDrugs.com2024-06-16
Web
Critical
Molding Lies Into Reality || Exploiting CVE-2024-4358
Researcher blogProgress (Telerik)2024-06-03
Web, Source Code
Not rated
Targeting an industrial protocol gateway
Researcher blogHMS Networks2024-05-30
Web
Not rated
Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)
Researcher blogZscaler2024-05-27
Windows
Not rated
Authentication & Registration Bypass in Newspack Extended Access
HackerOneAutomattic2024-05-20
Web
Medium
Changing the administrator password via admin console does not invalidate other sessions
HackerOnePortSwigger Web Security2024-05-20
Web
Low
Full Disclosure: A Look at a Recently Patched Microsoft Graph Logging Bypass - GraphNinja
Researcher blogMicrosoft (Microsoft Graph)2024-04-29
Web
Not rated
CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPE
HackerOneInternet Bug Bounty2024-04-28
Web
Medium
Unprotected Atlantis Server at https://152.70.█.█
HackerOne8x82024-04-11
Web
Medium
Web
Not rated
Oauth Misconfiguration Leads to 0-Click ATO
Medium2024-04-02
Web
Not rated
Improper Authentication (Login without Registration with any user) at ████
HackerOneU.S. Dept Of Defense2024-03-22
Web
High
Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]
HackerOneU.S. Dept Of Defense2024-03-22
Web
Critical
Authentication Bypass with usage of PreSignedURL
HackerOneownCloud2024-03-22$2,000 bounty
Web, Cloud
High
From Discovery to Disclosure: ReCrystallize Server Vulnerabilities
Researcher blogReCrystallize Software2024-03-22
Web
Not rated
Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices
Researcher blogErxes2024-03-21
Web, API, Source Code
Not rated
Subdomain Fuzzing worth 35k bounty!
Medium2024-03-18$35,000 bounty
Web
Not rated
Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to Organization
HackerOneGitHub2024-03-15
Web
Medium
Hacking My ISP Part 1: Exposing a Critical Bug Allowing SIM Swapping
GitHub2024-03-07$15,000 bounty
Web
Not rated
Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems
Researcher blog2024-03-05
Web
Not rated
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities
Researcher blogJetBrains (TeamCity)2024-03-04
Web, Source Code
Not rated
Showing the 150 most recent of 171. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.