---
id: 1888
title: "One Endpoint. Zero Credentials. Eight Confirmed Vulnerabilities."
source_domain: tenzai.com
source_url: "https://www.tenzai.com/blog/one-endpoint-zero-credentials-eight-confirmed-vulnerabilities"
published_at: "2026-06-25 00:00"
tags: ["ai-security", "bug-bounty", "information-disclosure", "api-security", "authentication", "case-study", "oauth", "timing-attack", "tenzai", "ai-hacker"]
phying_url: "https://phying.com/item/1888"
lang: en
---

# One Endpoint. Zero Credentials. Eight Confirmed Vulnerabilities.

## Summary

Tenzai's AI hacker documents eight confirmed vulnerabilities on a single OAuth token endpoint, from unmasked tech stack leakage to extracting client IDs character by character via response timing.

## Intelligence Metadata

- **Sources:** tenzai.com
- **Published:** 2026-06-25 00:00
- **Original:** https://www.tenzai.com/blog/one-endpoint-zero-credentials-eight-confirmed-vulnerabilities
- **Phying News:** https://phying.com/item/1888