---
id: 3808
title: "Shynet | VERSION 0.13.1"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/shynet-version-0-13-1"
published_at: "2026-06-18 00:00"
tags: ["appsec", "vulnerability-research", "security-audit", "web-security", "vulnerability-disclosure", "shynet", "stored-xss", "password-reset-poisoning"]
phying_url: "https://phying.com/item/3808"
lang: en
---

# Shynet | VERSION 0.13.1

## Summary

Bishop Fox's audit of Shynet 0.13.1 found two unauthenticated flaws: stored XSS via analytics location/referrer fields, and password-reset poisoning via a spoofed Host header; fixed in 0.14.0.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2026-06-18 00:00
- **Original:** https://bishopfox.com/blog/shynet-version-0-13-1
- **Phying News:** https://phying.com/item/3808