---
id: 5229
title: "How XBOW Found a Scoold Authentication Bypass"
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-scoold-vuln"
published_at: "2024-11-14T01:00:00Z"
tags: ["arbitrary-file-read", "vulnerability-research", "open-source", "authentication-bypass", "scoold", "hocon"]
phying_url: "https://phying.com/item/5229"
lang: en
---

# How XBOW Found a Scoold Authentication Bypass

## Summary

XBOW's autonomous auth bypass in Scoold, the open-source Q&A platform: unauthenticated attackers could read or modify the instance config and, via HOCON quirks, read arbitrary files on the host.

## Intelligence Metadata

- **Sources:** xbow.com
- **Published:** 2024-11-14T01:00:00Z
- **Original:** https://xbow.com/blog/xbow-scoold-vuln
- **Phying News:** https://phying.com/item/5229