Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I break software before someone worse does.
Security research and bug bounty, done the boring way: reported to the vendor, fixed, then written up here.
Latest writeups / 3
all writeups →Auditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
From the ledger / 5 of 34
full ledger →
vinext
Authentication bypass via i18n locale prefix; middleware matcher evaluates unsanitized pathname
vinext
Middleware header sanitization bypass; missing x-middleware-override-headers allows header spoofing
vinext
Reflected XSS via unescaped attribute names in next/head SSR serializer
OpenReception
one tenant’s throttle row disables the PIN brute-force throttle for the same identifier in other tenants
OpenReception
invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie