Loading story…
Security researchers and bug bounty hunters have demonstrated that business logic vulnerabilities—flaws in the intended workflow or assumptions of an application—can lead to significant financial and security impacts. These bugs often bypass traditional security controls, such as WAFs and automated scanners, because the code functions as designed, but the underlying business assumptions are flawed. Attackers exploit these logic errors to bypass restrictions, drain resources, or gain unauthorized access, resulting in substantial payouts for those who discover and responsibly disclose them.
Recent examples include bypassing admin authentication by manipulating HTTP response codes, allowing unauthorized password changes, and exploiting race conditions to circumvent voucher limits in web applications. These incidents highlight the importance of thoroughly testing business logic and not relying solely on technical controls, as attackers often find creative ways to exploit the intended functionality of systems for unintended gain.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The researcher found that by manipulating the application's HTTP response handling—changing a 302 redirect to a 200 OK response—they could bypass authentication on the admin portal. The flaw enabled unauthorized access and allowed the admin account password to be changed.
A security researcher used Google dorks to identify a private vulnerability disclosure program and then enumerated the target with feroxbuster, discovering an /admin portal. This reconnaissance led to the identification of a serious authentication weakness.
In the FLAG SHOP 2.0 CTF challenge, a race condition in the web application's voucher system allowed a user to bypass the one-voucher-per-name restriction and obtain multiple vouchers for the same name. This made it possible to satisfy the challenge requirement of collecting five matching vouchers to buy the flag.
In 2024, a researcher found that an enterprise event-registration platform trusted client-supplied checkout fields such as discount and total amount, allowing a premium conference ticket priced at ₹30,000 to be reduced to ₹1. The manipulated transaction was accepted, a real ₹1 payment was processed, and a valid premium registration was issued before the issue was responsibly disclosed and later patched.
A researcher reported that an entertainment platform's phone verification could be bypassed by manipulating the OTP verification response, allowing account creation with arbitrary phone numbers. They also found the signup API trusted client-supplied subscription fields, enabling creation of accounts with active paid plans without payment and modification of subscription duration and dates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourceosintteam.blog
Open sourceinfosecwriteups.com
Open sourceinfosecwriteups.com
Open sourceblog.securitybreached.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security researchers have documented the discovery and exploitation of critical vulnerabilities in web applications that can lead to full account takeover, data leakage, and privilege escalation. One researcher identified a business logic flaw involving inconsistent validation between client-side and server-side checks, which allowed unauthorized access to premium account features without payment. Another case involved a password change functionality that, due to improper implementation, enabled attackers to compromise user accounts entirely, with a CVSS score of 8.3 highlighting its severity. Blind XSS vulnerabilities were also reported, where payloads injected into user-facing forms were later triggered in privileged internal dashboards, resulting in session hijacking and potential compromise of sensitive systems. A critical OAuth misconfiguration was found, where manipulation of the redirect_uri parameter enabled attackers to steal JWT tokens, granting them unauthorized access to user accounts. Misconfigured Cross-Origin Resource Sharing (CORS) headers were exploited to escalate privileges, allowing attackers to become administrators and exfiltrate sensitive data across domains. Another researcher demonstrated how error messages and exposed API endpoints could be leveraged to enumerate and access sensitive backend systems, increasing the attack surface. The exposure and leakage of JWT tokens in server responses were shown to facilitate privilege escalation and impersonation of any user on the platform. Cache poisoning attacks against CDN infrastructure were also detailed, where improper cache key handling resulted in users receiving cached responses containing other users' private data, leading to widespread session hijacking. These incidents underscore the importance of secure implementation of authentication, authorization, and session management mechanisms. The vulnerabilities described were discovered through a combination of manual testing, creative payload injection, and analysis of application logic rather than automated scanning. Proof-of-concept exploits were provided for several of the vulnerabilities, demonstrating the ease with which attackers could compromise accounts or escalate privileges. The affected applications often failed to implement proper input validation, secure token handling, and least-privilege access controls. In several cases, the vulnerabilities were reported responsibly to the affected organizations, resulting in remediation and, in some instances, significant bug bounty rewards. The reports highlight the ongoing risk posed by business logic flaws, misconfigurations, and insufficient security controls in modern web applications. Security teams are advised to conduct thorough code reviews, implement robust validation on both client and server sides, and regularly audit authentication and authorization flows. The findings also emphasize the need for continuous monitoring and testing of production systems to detect and remediate such vulnerabilities before they can be exploited by malicious actors. Overall, these real-world cases provide actionable insights for organizations seeking to strengthen their web application security posture.
Jul 12, 2026
Security researchers uncovered significant vulnerabilities in web applications due to broken access control mechanisms, leading to unauthorized privilege escalation and potential system compromise. In one case, a researcher discovered that a SaaS platform inadvertently exposed administrative functionalities to regular users. By simply signing up for a free trial, the user noticed an admin panel link was visible, which should not have been accessible to non-privileged accounts. Initial attempts to access the admin panel resulted in a 403 Forbidden error, but further probing revealed that the access control checks were insufficiently enforced. Through a series of advanced techniques, the researcher was able to escalate privileges, ultimately gaining access to sensitive administrative features and potentially compromising the entire system. This highlights the critical risk posed by misconfigured or broken permission models in enterprise SaaS environments, where a single oversight can grant attackers broad access to internal resources. In a separate incident, a security tester examining a hospital website identified two PHP endpoints protected by 403 Forbidden responses. Despite the initial access denial, the tester experimented with different HTTP methods and payloads, eventually bypassing the restriction by switching from a GET to a POST request and supplying the required form data. The server processed the request as if it were legitimate, exposing a workflow flaw that could allow unauthorized users to submit sensitive information or interact with backend systems. The tester replicated this technique on another endpoint, confirming that the access control logic was consistently weak across multiple parts of the application. Both incidents underscore the prevalence of insecure direct object references and improper authorization checks in modern web applications. Attackers can exploit these weaknesses to move laterally within systems, access confidential data, or disrupt critical workflows. The findings demonstrate the importance of rigorous access control validation, including proper segregation of user roles and comprehensive testing of all endpoints for privilege escalation vectors. Organizations are urged to review their authentication and authorization mechanisms, implement least privilege principles, and conduct regular security assessments to identify and remediate such vulnerabilities before they can be exploited. These real-world examples serve as a cautionary tale for developers and security teams, emphasizing that even seemingly minor oversights in access control can have far-reaching consequences for data security and operational integrity.
Jul 12, 2026
Security researchers uncovered several critical vulnerabilities in popular web applications through bug bounty programs, demonstrating the risks posed by insecure coding practices and insufficient input validation. One researcher found a flaw in a car-parts marketplace that allowed manipulation of a URL parameter to set product prices to zero, exploiting a backend logic error where an invalid `id_product_feature_set` parameter defaulted the price to zero. Another report detailed a $1,000 bounty for a GitLab GraphQL API vulnerability that enabled project maintainers to delete entire repositories, bypassing intended permission restrictions and highlighting the importance of robust access control in API design. Additionally, a researcher discovered a $10,000 vulnerability in Shopify's Return Magic app, where a Handlebars template injection in customizable email templates could lead to server-side code execution, potentially allowing full server takeover. These incidents underscore the value of bug bounty programs in identifying and mitigating high-impact security flaws before they can be exploited by malicious actors, and they emphasize the need for secure development practices, thorough code review, and regular security testing in web applications.
Jul 12, 2026