~/disclosures
Findings from real research, published responsibly. Details are withheld until vendors have had time to remediate — these writeups focus on root cause, impact and lessons, not exploits.
4 disclosures · 4 categories · redacted by default
Disclosure policy
Every finding here follows a coordinated disclosure process. Technical specifics — endpoints, parameters, tokens, and reproduction steps — are intentionally omitted while remediation is in progress. If you operate an affected service and need the full report, reach out through the published security channel.
Kaltura's self-serve signup issued live, authenticated partner accounts without ever verifying the email — an unvalidated CAPTCHA, a verification secret returned in the API response, and a login path that never checked verification status at all.
Vercel's OAuth 2.0 introspection endpoint returned full token claims to any caller, with no client authentication and no rate limiting. The sibling revocation endpoint enforced credentials — which is what turned this from a design choice into a wiring gap.
An identity endpoint on NBA's consumer platform accepted writes to payment and subscription linkage identifiers that should never be client-controlled. A case study in incomplete allowlists and why one validated field is the loudest signal in the response.
OPPO's step-up verification page on id.oppo.com could be framed by any origin and opened a MessageChannel to its parent without checking event.origin. The browser handed the authentication result to the attacker's frame instead of the legitimate one.