Discussion on "From Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was Enough"

Abdulaziz Saad · 2026-07-30T13:41:06.044Z

Severity: CriticalBounty: $1,805Program: Private Bug BountyPlatform: Bugbounty.sa This started as a straightforward profile IDOR. An authenticated user could change a userid parameter and load another

Discussion on "From Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was Enough" | Hashnode

Search Hashnode

From Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was Enough

Responses1