Auditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
I break software before someone worse does.
Security research and bug bounty, done the boring way: reported to the vendor, fixed, then written up here.
Latest writeups / 3
all writeups →Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
Bypassing Wazuh's UNC Mitigation in Windows OSQuery via \\?\UNC\ (CVE-2025-30201 / GHSA-x697-jf34-gp5x)
How I bypassed Wazuh's UNC path mitigation in Windows OSQuery using extended-length UNC paths (\\?\UNC\), leaking NetNTLMv2 hashes despite the original CVE-2025-30201 fix.
From the ledger / 5 of 29
full ledger →
Gitea
SSRF via HTTP redirect in repository migration allows authenticated users to bypass internal address restrictions and reach localhost or private-network services
MiniUPnP
heap over-read in UPnP event callback URL host parsing (upnpevents.c)
Zammad
PGP email verification handler discards GPG return values, falsely marking all inbound signed emails as valid signatures
Zammad
unauthenticated request to OTRS import controller endpoint blocks request workers for ~115 seconds, enabling denial of service
Zammad
knowledge base permission checks allow users with limited read permissions to access items outside their assigned scope