PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How an Improper Access Control Vulnerability Led to Account Theft in One Click

hackerone.com | vulnerability | #bug-bounty | #access-control | #account-takeover | #vulnerability | #hackerone | #authorization
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Improper access control is the second most common bug bounty vulnerability, per HackerOne's report. The article explains how weak authn/authz controls enable account theft and how to remediate.
Published
Collected

Related coverage

vulnerability · projectdiscovery.io
Introducing Neo Triage
On October 26, 2026 we're releasing Neo Triage, an autonomous engine for vulnerability triage. While other tools rank your backlog, Neo clears it.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · netspi.com
Detecting Authorization Flaws in Java Spring via Source Code Review (SCR)
Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.
vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Critical · vulnerability · bishopfox.com
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.
Back