Llorenç RomàPosts tagged
4posts
A client-controlled user_id in MobiAPParc’s password recovery flow allowed arbitrary password resets. Predictable IDs, email enumeration, and missing rate limiting increased the impact.
Read the articlePre-Account Takeover, the forgotten one.
Read the articleA session cookie rejected by the token refresh endpoint continued to be accepted by a GraphQL mutation endpoint for 20 minutes after password reset — here's how I found it, proved it, and reported it.
Read the articleA pre-registration flaw in DroneAware Node allowed silent account takeover — any user authenticating via Google SSO or email verification could have their account hijacked.
Read the article