Skip to content
Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint
labs.cognisys.group | blog | #information-disclosure | #api-security | #oauth | #stripe | #credentials | #black-box
Summary
A black-box assessment found an unauthenticated GET endpoint exposing live OAuth configurations: client IDs, secrets, and keys for all integrations, including production Stripe credentials.
- Published
- Collected