Documented security research, business logic flaws, and vulnerability disclosures across YesWeHack and Intigriti. Every report adheres strictly to responsible disclosure principles.
€1,100
YesWeHack Bounties Awarded
8
Validated Disclosures (5 Bounties + 3 Triaged)
+78 pts
Reputation Points Earned
100%
Vendor Confirmed & Remediated
Looking for 7,400+ Global Bug Bounty Reports?
I built Hunter Archive — a high-speed searchable threat intelligence index aggregating 7,400+ curated writeups from Pentester.land, PortSwigger, Project Zero, and HackerOne.
MEDIUM • CVSS 4.3YesWeHack Bounty€200 Awarded (+14 pts)
CWE-364 • Race Condition
Race Condition Allows Multiple Captures of Same Item & Repeated Voids
Identified a non-atomic concurrency vulnerability in a major enterprise payment gateway API. By firing 10 parallel partial-capture requests for the exact same order item, 6 independent captures succeeded concurrently before limits were evaluated, capturing €180.00 for a single €30.00 item. Subsequent parallel void requests produced duplicate cancellations, violating core transactional invariants: sum(captures) + sum(cancellations) = 225.00 > 185.00 authorized amount.
Verified YesWeHack Reward: Report accepted by security triage. Awarded €200 bounty + 14 reputation points for discovering atomic state transition failure in financial checkout workflow.
MEDIUM • CVSS 6.5YesWeHack Bounty€300 Awarded (+20 pts)
CWE-840 • Business Logic
Business Logic Flaw: Order Authorization Accepted with Empty Items Array
Discovered that the /api/v3/checkout/authorize endpoint in an enterprise payment processing API failed to enforce product catalog integrity, allowing checkout authorization even when the items: [] array was completely empty. The backend trusted client-supplied totals (e.g. €100.00) without verifying underlying goods, and permitted arbitrary price manipulation (authorizing orders at €1.00), violating the documented invariant TotalGrossAmount = Σ(items.grossUnitPrice × quantity).
Verified YesWeHack Reward: Confirmed by engineering as unintended business logic flaw. Awarded €300 bounty + 20 reputation points for report quality and impact proof.
Business LogicCWE-840Price ManipulationCheckout Retail APIYesWeHack
Legal Age Verification Bypass in Checkout Payment API Enabling Minor Debt Incurrence
Identified an absence of semantic age validation on POST /api/v3/checkout/authorize via parameter customer.birthDate. The endpoint accepted declared birthdates for 6-year-olds (2020-01-01) and future dates (2030-01-01). Through full transaction lifecycle testing, I demonstrated that an underage order proceeded from authorization into capture, generating real legal billing artifacts and invoice OCR references (ocr: 1900006925080170), directly violating EU Consumer Credit Directive (2023/2225) regulations.
Verified YesWeHack Reward: Triaged at CVSS 9.1 Critical. Engineering re-aligned decision engine configuration to enforce age verification, rejecting minors with code 200.001 Customer too young. Awarded €200 bounty + 14 pts.
Legal Age BypassRegulatory ComplianceInvoice GenerationZoral Risk EngineYesWeHack
MEDIUM • CVSS 4.3YesWeHack Bounty€200 Awarded (+14 pts)
CWE-840 • State Machine Flaw
Unauthorized Cancellation of Pending Orders via Void Authorization Endpoint
A workflow enforcement flaw in a payment API permitted callers to void transactions while an order was still in Pending status before any payment authorization occurred. Calling POST /api/v3/orders/{orderNumber}/voids transitioned uncompleted customer orders into Cancelled, allowing competitors or malicious actors to automate checkout sabotage across in-progress orders.
Verified YesWeHack Reward: Validated by security team. Patched by enforcing state machine transition rules (Pending → Authorized → Captured). Awarded €200 bounty + 14 pts.
State Machine BypassOrder Void FlawCWE-840PostmanYesWeHack
MEDIUM • CVSS 4.3YesWeHack Bounty€200 Awarded (+14 pts)
CWE-840 • Payment Manipulation
Negative Item Quantity Accepted in Checkout Authorization & Capture Flow
The checkout authorization endpoint failed to enforce boundary checks on product quantities, accepting quantity: -1 in the order items payload. The transaction successfully completed through full authorization and settlement capture (capturedAmount: 119.0000), exposing an arithmetic validation gap that could disrupt accounting integrity and downstream tax calculation.
Verified YesWeHack Reward: Accepted by vendor. Patched with input validation rejecting non-positive quantity values. Awarded €200 bounty + 14 pts.
Payment ManipulationQuantity TamperingCWE-840Burp Suite ProYesWeHack
MEDIUM • CVSS 6.1YesWeHack ValidatedDuplicate • +1 pt Awarded
CWE-601 • Open Redirect
Unauthenticated Callback Endpoint Redirects to Unsafe Schemes (javascript: / data:)
An unsafe redirect vulnerability was identified in an enterprise hosted checkout payment workflow. The backend accepted and persisted arbitrary schemes in the merchantUrl parameter (including javascript:alert(1) and data:text/html,...) during checkout session creation. When resolving the transaction callback via GET /api/v3/orders/{orderUuid}/notifyStatus, the application issued an unauthenticated 302 Found reflecting the attacker-controlled value into the Location header, enabling trust boundary abuse and executable client-side redirection directly following payment flows.
YesWeHack Triaged Finding • #YWH-PGM40625-13
Security Triage Confirmation: Confirmed reproducible by YesWeHack security triage team. Closed as Duplicate with 1 point awarded to profile ranking for high-fidelity technical reproduction and impact demonstration.
Open RedirectCWE-601Stored RedirectTrust BoundaryYesWeHack
MEDIUM • CVSS 5.3YesWeHack ValidatedDuplicate • +1 pt Awarded
CWE-434 • Unrestricted File Upload
Inconsistent File Upload Validation Allows SVG Files with Embedded JavaScript
During registration and onboarding via POST /api/cda/auth/signup, the application permitted base64-encoded document uploads (e.g., identity verification proofs). While front-end controls purported to restrict files to raster images and PDFs, backend validation only verified file extensions without checking true MIME signatures or sanitizing XML elements. This allowed attackers to upload SVG files carrying embedded script tags (<script>alert(1)</script>), enabling stored client-side execution in administrative verification workflows.
YesWeHack Triaged Finding • #YWH-PGM13810-5
Security Triage Confirmation: Confirmed by security team. Closed as Duplicate with 1 point awarded to profile ranking for demonstrating inconsistent validation and stored SVG execution.
MEDIUM • CVSS 6.5Intigriti VDPTriaged Duplicate • Code Review
CWE-295 • Improper Certificate Validation
Hardcoded TLS Certificate Verification Bypass (InsecureSkipVerify: true) in OpenFeature Provider
During static analysis of an open-source observability platform's feature management subsystem (pkg/services/featuremgmt/openfeature.go), discovered that the remote OpenFeature HTTP provider client hardcoded TLS certificate verification to InsecureSkipVerify: true. While global configuration options (tls_skip_verify_insecure = false) enforced rigorous TLS validation across other subsystems, the OpenFeature client bypassed all x509 validation. This opened feature evaluation traffic to Man-in-the-Middle (MITM) tampering, allowing attackers in network transit to manipulate feature toggles and activate unreleased or debug functionality.
Intigriti VDP Finding • #GRAFANA-Y9DGLCA7
Security Triage Confirmation: Triaged on Intigriti platform. Confirmed valid vulnerability in source code review; archived as duplicate matching concurrent internal security auditing.
Go SecurityCWE-295TLS MITMCode ReviewIntigriti VDP
