A public sign-up flow let an anonymous attacker set the tenant ID attribute on their own new account. The backend trusted that claim, granting full directory access to any customer's tenant from a single self-registered account.
Apr 29, 2026An enterprise SaaS platform let a team admin invited from a different customer remove the team's original creator and permanently delete the team. The owner's senior administrator role provided no override.
Apr 29, 2026A national mobile carrier's chatbot backend exposed unauthenticated subscriber lookup endpoints, enabling bidirectional resolution between phone numbers and SIM card identifiers, plus account history, plan status, payment status, and roaming status for the entire customer base.
Apr 25, 2026A national mobile carrier's prepaid backend issued globally-shared sequential purchase keys with no session binding, letting an unauthenticated attacker poll the live transaction database and harvest thousands of customer purchase records per day.
Apr 25, 2026A national mobile carrier's customer-facing host exposed an internal operator backend whose security filter chain failed to cover the OTP SMS dispatcher, six data export controllers, and three administrator login endpoints, all reachable unauthenticated from the internet.
Apr 25, 2026A retail trading broker's Android app validated in-app browser URLs with a substring check, letting any URL that contained the brand domain pass. One tap on a feed link injected the user's session tokens into the attacker's origin and enabled full account takeover.
Apr 24, 2026An exported activity in a robot vacuum companion app deserialized an attacker-supplied destination, loaded an attacker URL inside a privileged WebView, and leaked an identity-provider auth code that hijacked the victim's session on connected web properties.
Apr 22, 2026A single-tap deep link on a regulated digital-asset exchange's Android app loaded an attacker page inside a privileged JS bridge, exfiltrating the live session JWT and authenticating the full trading API.
Apr 18, 2026A national mobile carrier's Android app combined a hardcoded deep link service key, an autoVerify domain handoff, and a custom-scheme WebView with no host check, enabling in-app credential phishing under the carrier's own verified domain.
Apr 17, 2026A missing host check on a centralized crypto exchange's Android DApp deep link, combined with a stale on-device safety whitelist, enabled a one-tap unlimited ERC-20 permit signature capture and wallet drain.
Apr 17, 2026