YRON

// case studies

Real findings. Real impact.

A sample of the vulnerabilities we've surfaced in real engagements. Every case is fully anonymized — no client name, domain, or sensitive detail is disclosed. Sanitized full reports are shared on request under NDA.

Request a sample reportExplore services
0+

Accepted reports

0+

Disclosed bounties (USD)

0+

Programs reported to

0%

Bugcrowd accuracy

// selected findings

Six engagements. Six stories worth telling.

High · CVSS 8.1

Industrial technology · HackerOne · Coordinated disclosure

ABB — Authentication bypass via Next.js Server Actions (CVE-2025-55184)

Improperly validated Next.js Server Actions on ABB's platform allowed authentication to be bypassed on protected surfaces. Reported, fixed, and assigned CVE-2025-55184.

Attack chain

  • 1Mapped exposed Server Action endpoints on the Next.js app
  • 2Identified missing session/authorization checks inside action handlers
  • 3Invoked privileged actions without a valid authenticated session

Business impact

  • Authentication controls bypassed on protected functionality
  • Assigned a public CVE (CVE-2025-55184)
  • Class of bug — affects other Next.js apps with the same pattern

Remediation

  • Enforced session + authorization checks inside every Server Action
  • Centralized action-level auth wrapper across the codebase
  • Added negative tests for unauthenticated action invocation

CVE

2025-55184

Severity

High

Status

Resolved

Critical · CVSS 9.1

Amazon / Audible · Mobile · Coordinated disclosure

Audible (Amazon) — Hardcoded AWS Cognito credentials in Android APK

Six hardcoded Cognito Identity Pool IDs were discovered inside the production Audible Android APK — granting unauthenticated write access to production Kinesis streams and AWS Pinpoint across four AWS accounts.

Attack chain

  • 1Pulled the production APK and decompiled with jadx
  • 2Extracted 6 embedded Cognito Identity Pool IDs
  • 3Exchanged them for temporary AWS credentials with active write scope

Business impact

  • Unauthenticated write to production Kinesis streams
  • Abuse of AWS Pinpoint messaging across 4 AWS accounts
  • Analytics / telemetry pipeline poisoning at scale

Remediation

  • Revoked and re-scoped the exposed Cognito Identity Pools
  • Moved to authenticated identity flows with least-privilege roles
  • Added mobile secret-scanning to the release pipeline

Cognito IDs

6

AWS accounts

4

Services hit

Kinesis · Pinpoint

Critical · CVSS 9.3

E-commerce · India · Private disclosure

Poorvika — Payment bypass via UPI callback tampering

A cancelled UPI transaction could be modified client-side to reflect a success status. The absence of server-side PayU verification meant orders were confirmed without any real payment ever settling.

Attack chain

  • 1Initiated a real UPI payment and cancelled it mid-flow
  • 2Intercepted the PayU callback and flipped status → SUCCESS
  • 3Order confirmed and dispatched — no server-side re-verification

Business impact

  • Free checkout on arbitrary order values
  • Direct revenue loss and inventory shrinkage
  • Trivially scriptable — no chained exploit needed

Remediation

  • Server-side PayU status verification on every callback
  • Signed + replay-protected payment webhooks
  • Reconciliation job comparing gateway ledger vs orders

Payment step

Bypassed

Effort

Client-side only

Root cause

No server verify

Critical · CVSS 9.6

AI product · Private program · Coordinated disclosure

Kimi AI — 1-click account takeover via stored XSS

A stored XSS was triggerable via a crafted ShareChat share link. A single click by an authenticated user was enough to fully take over the account — no further interaction, no visible cue.

Attack chain

  • 1Crafted a malicious ShareChat share payload
  • 2Payload persisted and rendered inside the authenticated app
  • 3Session material exfiltrated → full account takeover on click

Business impact

  • One-click ATO on any authenticated user
  • Zero user awareness — no prompt, no redirect
  • Chat history, credentials and connected data at risk

Remediation

  • Context-aware output encoding on shared content
  • Strict CSP with nonce-based script allowlist
  • Share-link content sanitizer + review pipeline

User interaction

1 click

Outcome

Full ATO

Vector

Stored XSS

High · CVSS 8.2

Healthcare · Intigriti · Coordinated disclosure

Redcare Pharmacy — Parameter pollution → ATO via deep link

Parameter pollution defeated origin validation on a deep-link handler, allowing an attacker-controlled origin to complete an authentication flow and take over the victim's account. A separate one-click ATO on the same program was rated Exceptional.

Attack chain

  • 1Injected duplicate parameters into the deep-link URL
  • 2Origin validator picked the attacker-controlled value
  • 3Auth flow completed against attacker origin → ATO

Business impact

  • Account takeover on click of a crafted link
  • PHI and order history exposure per victim
  • Second one-click ATO on same program rated Exceptional

Remediation

  • Reject duplicated auth-critical query parameters
  • Exact-match origin allowlist for deep-link redirects
  • Regression tests for parameter pollution across handlers

Bounty

€1,500

Severity

High · 8.2

Platform

Intigriti

High · CVSS 7.8

TripAdvisor / Viator · Android · Bugcrowd · Coordinated disclosure

Viator — Session token exfiltration via exported DeepLinkActivity

An exported DeepLinkActivity on the Viator Android app leaked the user's session token to any locally installed app that could craft the right intent. Verified end-to-end with live token capture.

Attack chain

  • 1Enumerated exported components in the production APK
  • 2Crafted an intent that reached DeepLinkActivity from a 3rd-party app
  • 3Captured a live session token belonging to the victim account

Business impact

  • Any installed app could hijack the Viator session
  • Direct account takeover with no phishing required
  • Reproducible with a live proof-of-concept

Remediation

  • Marked the activity non-exported / added intent validation
  • Scoped session tokens out of intent extras and URIs
  • Added Android component-export review to release checks

Bounty

$750

Platform

Bugcrowd

PoC

Live token

// how we get there

The path from scope to signed-off fix.

Scope

Threat-model your surface with you. No cookie-cutter checklists.

Exploit

Manual testing led, tooling augmented. Chains, not just findings.

Report

Reproducible steps, developer-first fixes, exec summary.

Retest

Free retest window. We verify every High/Critical is dead.

Want a sanitized full report?

We share a sample Stage-1 report during scoping calls so you can see exactly how findings are written, prioritized, and handed to your engineers.

Request sampleView pricing