How XBOW Found a Scoold Authentication Bypass

XBOW's autonomous auth bypass in Scoold, the open-source Q&A platform: unauthenticated attackers could read or modify the instance config and, via HOCON quirks, read arbitrary files on the host.