Security Researcher — writing about security findings, personal projects, and IT.https://llori.me/en-ushttps://llori.me/posts/droneaware-account-takeover-pre-registration/https://llori.me/posts/droneaware-account-takeover-pre-registration/A pre-registration flaw in DroneAware Node allowed silent account takeover — any user authenticating via Google SSO or email verification could have their account hijacked.Mon, 25 May 2026 00:00:00 GMTbug-findingresponsible-disclosureaccount-takeoverauthenticationcveSecurity Researchhttps://llori.me/posts/how-not-to-protect-your-content/https://llori.me/posts/how-not-to-protect-your-content/A travel app sold device-limited content packages protected by PDF passwords and GPS track encryption. On a rooted Android device, both the password and the tracks were sitting in cleartext in a SQLite database.Sat, 02 May 2026 00:00:00 GMTbug-findingresponsible-disclosureandroiddrmmobile-securitySecurity Researchhttps://llori.me/posts/u5cms-security-findings/https://llori.me/posts/u5cms-security-findings/A static SAML nonce in u5CMS allowed any authenticated user to forge sessions as an administrator, leading to RCE. Two additional XSS and open redirect issues were patched in the same release.Tue, 10 Mar 2026 00:00:00 GMTbug-findingresponsible-disclosurerceprivilege-escalationsamlcmsSecurity Researchhttps://llori.me/posts/garmin-mapshare-insecure-link-design-part-2/https://llori.me/posts/garmin-mapshare-insecure-link-design-part-2/Password-protected MapShares had unauthenticated API endpoints allowing location requests and inReach messaging — plus guessable identifiers exposing public maps.Wed, 04 Feb 2026 00:00:00 GMTbug-findingresponsible-disclosureprivacygarminapi-securitySecurity Researchhttps://llori.me/posts/garmin-inreach-insecure-link-design/https://llori.me/posts/garmin-inreach-insecure-link-design/A privacy issue in Garmin inReach allowed enumeration of map URLs due to short, guessable identifiers — exposing messages, locations, and contact details.Mon, 12 Jan 2026 00:00:00 GMTbug-findingresponsible-disclosureprivacygarminSecurity Research