A leaked deep-link key plus an open in-app WebView let an attacker render a fake confirmation page inside the genuine app, trigger a real verification email, and capture the code for full account takeover.
May 12, 2026A self-service signup form plus a broken-authorization invoice API leaked 316 invoice PDFs across 9 unrelated business partners in 6 countries, with records going back to 2017.
May 12, 2026An unauthenticated B2B signup endpoint on a live-experiences marketplace let any stranger become a manager inside any partner organisation and create real paid orders that were billed to the partner.
May 11, 2026A leaked package manifest on an events marketplace exposed an unclaimed internal scope and wildcard package names reachable from live payment-card collection code, physical venue kiosks, and the build pipeline.
May 8, 2026An internal analytics assistant API on a staging host was missing authentication while holding production data, exposing 3.3M ticket records and signed download URLs for live future events.
May 8, 2026An authorization check was missing on one sub-path of a wealth platform's investor account API, letting any logged-in user read another user's full identity record and corrupt the victim's display name.
May 8, 2026A financial advice and superannuation platform's policy disabled customer self-registration, but the backend issued a Client-role session anyway. Two unauthorized data endpoints exposed 615 fact-find records and full client profiles.
May 5, 2026A chatbot integration accepted another tenant's authorization-object ID with no ownership check. Posting three small numbers exposed cleartext-equivalent Authorization headers for another customer's basic, bearer, and OAuth credentials.
May 1, 2026An enterprise SaaS chatbot integration accepted attacker-supplied destination URLs and echoed the upstream response back. DNS rebinding bypassed the IP allow-list and reached the cloud metadata service.
Apr 29, 2026An enterprise SaaS platform exposed encrypt and decrypt API endpoints to every authenticated tenant with no role guard and a single global key, letting any customer decrypt any other customer's stored secrets byte-for-byte.
Apr 29, 2026