Five case labels in the same switch checked org membership. Three didn't. Eighth writeup in my Bitwarden series. The Events service ingests client-submitted telemetry at POST...
The server looked up the victim by the email in my request body — then never checked that email was mine. The latest writeup in my Bitwarden series, and my favorite of the set: a...
The single-user remove path blocked Custom → Admin. The bulk path forgot to. Fourth writeup in my Bitwarden series, and a textbook *incomplete-coverage* bug. A role-hierarchy...
A display name is a string. Concatenated into a JSON template, it's a payload. Sixth writeup in my Bitwarden series. The integration template engine built webhook JSON by...
[InjectOrganization] loaded the organization. It never checked you were in it. Fifth writeup in my Bitwarden series. An action filter that looked like an authorization check but...
The column was widened to 300. The lookup that reads it stayed at 50. SQL Server truncated the difference without a word. Another writeup in my Bitwarden series. This one is not...
The auth gate had an early return for the empty case. The "common case" was the bypass. Third writeup in my Bitwarden series. A single early-return in an authorization check let...
One != in front of an &&. The first operand was the bypass, not the password check. Second writeup in my Bitwarden series. This one is a re-authentication bypass on the...
Two endpoints in the same controller. The GET filters by ownership. The POST does not. That's the whole bug. This is a writeup of a missing-authorization vulnerability I reported...
"In August 2025, James Kettle's latest research netted significant bug bounties in just two weeks, compromising tens of millions of websites. Request smuggling isn't dying—it's...
"The highest-leverage recon is usually not 'more tools' — it's better questions encoded as search queries. I've earned over $50,000 from dorking alone." Dorking is one of those...
"In 2023-2024, GraphQL vulnerabilities accounted for over $2.5M in bug bounty payouts across major platforms. The attack surface is massive, yet most testers still approach it...
▶ More writeups coming soon...
[EOF]