Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I break software before someone worse does.
Security research and bug bounty, done the boring way: reported to the vendor, fixed, then written up here.
Latest writeups / 3
all writeups →Auditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
From the ledger / 5 of 39
full ledger →
Wazuh
merged-file header path traversal in cluster sync allows a cluster peer to write arbitrary files under WAZUH_PATH and reach root code execution
Wazuh
DAPI tmp_file path injection lets a cluster peer read arbitrary master files and forge REST API administrator tokens
Wazuh
peer-controlled metadata key in cluster sync allows arbitrary file writes under WAZUH_PATH and root code execution on the manager
GlobaLeaks
insufficient role enforcement allows non-admin internal users on the root or management tenant to read and modify network configuration
GlobaLeaks
incomplete tenant scoping lets a non-root tenant admin clear secondary escrow backup keys across all tenants