Loading story…
Web applications are increasingly at risk of exposing sensitive information through misconfigured or poorly designed API responses, particularly those using JSON. Accidental JSON response disclosures can reveal secrets such as tokens, internal IDs, API keys, and debug data, which attackers can exploit for credential theft, account takeover, or privilege escalation. Security researchers have demonstrated safe methods for discovering these leaks, emphasizing the importance of robust detection and mitigation strategies for engineers and bug bounty hunters.
In addition to JSON leaks, related vulnerabilities such as hardcoded cryptographic keys in client-side JavaScript and web cache deception attacks further expand the attack surface. Hardcoded keys can allow attackers to decrypt sensitive data, while web cache deception tricks caching layers into storing and serving private user data as if it were public, exposing session tokens and personal information. These issues highlight the need for comprehensive security reviews of web application responses, proper key management, and careful configuration of caching mechanisms to prevent inadvertent data exposure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher discovered that a popular Content Delivery Network (CDN) was serving cached responses that exposed private user data at scale. By conducting mass reconnaissance and analyzing cache behaviors, the researcher identified that the CDN was returning sensitive information to unauthorized users due to improper cache controls and response header misconfigurations. This vulnerability allowed attackers to access confidential data simply by refreshing pages or manipulating request headers, highlighting the risks of relying on default CDN settings for sensitive web applications. In a separate incident, another researcher found that a web application's admin dashboard was accessible without any hacking or exploitation, due to exposed APIs and missing authorization checks. By identifying an API subdomain with publicly available documentation, the researcher was able to chain together several misconfigurations, escalating privileges from a normal visitor to full administrator access. Both cases underscore the critical importance of proper configuration and access controls in web infrastructure, as seemingly minor oversights can lead to significant data exposure and privilege escalation risks.
Jul 12, 2026
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026
Sensitive information such as passwords, API keys, and cloud credentials are frequently leaked in public code repositories like GitHub, often due to developer oversight. Attackers and automated bots actively monitor these repositories, quickly exploiting any exposed secrets to gain unauthorized access to systems and data, sometimes resulting in significant breaches. The prevalence of such leaks highlights a critical and ongoing risk for organizations that rely on public version control systems without robust security controls. Smaller websites are particularly vulnerable, as they often lack dedicated security teams, have limited budgets for penetration testing, and use outdated technologies or frameworks. These factors make them attractive targets for bug bounty hunters and malicious actors alike, who exploit logic flaws and misconfigurations. The client-server architecture of web applications further expands the attack surface, with vulnerabilities often hidden in the way requests and responses are handled, underscoring the importance of understanding web mechanics to identify and mitigate security risks effectively.
Jun 29, 2026