> Five case labels in the same switch checked org membership. Three didn't. Eighth writeup in my Bitwarden series. The Events service ingests client-submitted telemetry at POST...
> The server looked up the victim by the email in my request body — then never checked that email was mine. The latest writeup in my Bitwarden series, and my favorite of the set:...
> The single-user remove path blocked Custom → Admin. The bulk path forgot to. Fourth writeup in my Bitwarden series, and a textbook *incomplete-coverage* bug. A role-hierarchy...
> A display name is a string. Concatenated into a JSON template, it's a payload. Sixth writeup in my Bitwarden series. The integration template engine built webhook JSON by...
> [InjectOrganization] loaded the organization. It never checked you were in it. Fifth writeup in my Bitwarden series. An action filter that looked like an authorization check but...
> The auth gate had an early return for the empty case. The "common case" was the bypass. Third writeup in my Bitwarden series. A single early-return in an authorization check let...
> One != in front of an &&. The first operand was the bypass, not the password check. Second writeup in my Bitwarden series. This one is a re-authentication bypass on the...
> Two endpoints in the same controller. The GET filters by ownership. The POST does not. That's the whole bug. This is a writeup of a missing-authorization vulnerability I...
> "In August 2025, James Kettle's latest research netted significant bug bounties in just two weeks, compromising tens of millions of websites. Request smuggling isn't dying—it's...
> "The highest-leverage recon is usually not 'more tools' — it's better questions encoded as search queries. I've earned over $50,000 from dorking alone." Dorking is one of those...
> "In 2023-2024, GraphQL vulnerabilities accounted for over $2.5M in bug bounty payouts across major platforms. The attack surface is massive, yet most testers still approach it...
▶ More writeups coming soon...
[EOF]