地图 / Authentication bypass for ███ leads to take over any users account.

Authentication bypass for ███ leads to take over any users account.

身份认证 / Missing Authentication for Critical Function / #1608151

厂商: Krisp
严重程度: 高危
赏金: —
弱点: Missing Authentication for Critical Function
研究员: @20_root
披露日期: 2022-10-31
资产: api.krisp.ai
CVE: —

该报告还没有中文解读。

时间线

2022-06-21报告提交
2022-10-31公开披露

阅读 HackerOne 原文 ↗作者 @20_root · 版权归作者与 Krisp 所有

同类报告

Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · 2020-01-08 · $15,300 [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMail.ru · —Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadataShopify · 2026-11-03 · $3,100 Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open RedirectAWS VDP · 2026-10-16 Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · 2026-10-14 Administration page visible without authenticationVisma Public · — · $100