---
id: 6564
title: "Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform"
source_domain: samcurry.net
source_url: "https://samcurry.net/points-com"
published_at: "2023-08-03T00:00:00Z"
tags: ["bug-bounty", "path-traversal", "pii", "authorization-bypass", "points-com", "loyalty-programs"]
phying_url: "https://phying.com/item/6564"
lang: en
---

# Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform

## Summary

Flaws in points.com, backend behind many airline and hotel loyalty programs: path traversal exposed 22 million order records, and an auth bypass enabled points transfers and admin-site access.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2023-08-03T00:00:00Z
- **Original:** https://samcurry.net/points-com
- **Phying News:** https://phying.com/item/6564