Llorenç RomàA security researcher from Mallorca, now based in Switzerland. I write about interesting bugs, side projects, and things I figure out along the way.
A little about meA client-controlled user_id in MobiAPParc’s password recovery flow allowed arbitrary password resets. Predictable IDs, email enumeration, and missing rate limiting increased the impact.
Read the articlePre-Account Takeover, the forgotten one.
Read the articleA session cookie rejected by the token refresh endpoint continued to be accepted by a GraphQL mutation endpoint for 20 minutes after password reset — here's how I found it, proved it, and reported it.
Read the articleA pre-registration flaw in DroneAware Node allowed silent account takeover — any user authenticating via Google SSO or email verification could have their account hijacked.
Read the articleA travel app sold device-limited content packages protected by PDF passwords and GPS track encryption. On a rooted Android device, both the password and the tracks were sitting in cleartext in a SQLite database.
Read the articleA static SAML nonce in u5CMS allowed any authenticated user to forge sessions as an administrator, leading to RCE. Two additional XSS and open redirect issues were patched in the same release.
Read the articlePassword-protected MapShares had unauthenticated API endpoints allowing location requests and inReach messaging — plus guessable identifiers exposing public maps.
Read the articleA privacy issue in Garmin inReach allowed enumeration of map URLs due to short, guessable identifiers — exposing messages, locations, and contact details.
Read the articleA few experiments that made it out of the notebook.
Drone security · Open source
An open-source tool for crafting and transmitting drone Remote ID messages over Wi-Fi and Bluetooth. Built for researching protocol weaknesses and testing drone monitoring systems.
Drone security · Open source
An open-source monitoring application that captures drone Remote ID broadcasts over Wi-Fi and displays them on a map, with live monitoring, replay, and offline mapping.