# moltenbit

> Security research and coordinated disclosure by moltenbit: vulnerability writeups and CVEs.

I look for security bugs and publish them once they are fixed. This site holds my writeups and the ledger of every vulnerability I have disclosed. moltenbit is one person, a security researcher and bug bounty hunter.

- The ledger at https://moltenbit.net/security-research/ is the complete record: 51 disclosures, 44 of them with a CVE ID, from 2026-03-17 to 2026-10-26. Every finding was reported to the affected vendor and fixed before I published it.
- Each ledger entry has a stable anchor that does not change. A CVE is linked by its ID (`https://moltenbit.net/security-research/#<CVE-ID>`), any other entry by a fixed kebab-case name. Cite findings with these links.
- Severity is the rating published with the advisory, with the CVSS v3.1 base score where one exists. Acknowledgments without a rating have none.
- Writeups explain selected findings in depth: root cause, proof of concept, and fix. Some posts cover OSINT and tooling instead.
- Every page with content also exists as markdown: append `index.md` to its URL. The writeup and page links below point to these markdown versions.

## Security research

- [Security Research](https://moltenbit.net/security-research/index.md): the disclosure ledger with product, severity, date and references for every finding
- [Chia Network hall of fame](https://hackerone.com/chia_network): HackerOne. Ranked among the top contributors of the program.
- [Full text](https://moltenbit.net/llms-full.txt): the complete ledger and the full text of every writeup and page in one markdown file

## Writeups

- [Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement](https://moltenbit.net/posts/three-bugs-in-cloudflares-vinext-alpha/index.md): Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS. (2026-07-23)
- [Auditing OpenReception: 16 CVEs in an end-to-end encrypted appointment booking platform](https://moltenbit.net/posts/auditing-openreception/index.md): A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical. (2026-06-30)
- [Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)](https://moltenbit.net/posts/bypassing-zammad-ai-text-tool-authorization-via-rest-api/index.md): How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts. (2026-04-08)
- [Bypassing Wazuh's UNC Mitigation in Windows OSQuery via \\?\UNC\ (CVE-2025-30201 / GHSA-x697-jf34-gp5x)](https://moltenbit.net/posts/wazuh-unc-mitigation-bypass-cve-2025-30201/index.md): How I bypassed Wazuh's UNC path mitigation in Windows OSQuery using extended-length UNC paths (\\?\UNC\), leaking NetNTLMv2 hashes despite the original CVE-2025-30201 fix. (2026-03-17)
- [Detecting the Notepad++ Supply Chain Attack: A PowerShell Triage Script](https://moltenbit.net/posts/notepad-supply-chain-attack-triage-script/index.md): A PowerShell-based triage script to check systems for indicators of compromise related to the Notepad++ supply chain attack attributed to Lotus Blossom APT. (2026-02-04)
- [Combating Misinformation Through Geolocation: Colombian Trucker vs. Wind Energy](https://moltenbit.net/posts/combating-misinformation-through-geolocation/index.md): A Facebook video claimed to show wind turbine transport to Colombia. Using OSINT techniques, we traced it to Oklahoma, USA – here's how. (2025-05-26)
- [Custom Admin Notifications for New Intune Enrollments](https://moltenbit.net/posts/custom-admin-notifications-for-new-intune-enrollments/index.md): Intune lacks native admin alerts for new enrollments. This script fixes that – using Entra, Microsoft Graph API, and a simple Linux setup. (2025-05-25)
- [Gralhix OSINT exercise 005 walkthrough](https://moltenbit.net/posts/gralhix-osint-exercise-005-walkthrough/index.md): Geolocating a polar bear livestream screenshot: from reverse image search to exact coordinates using Google Earth, Street View, and historical weather data. (2025-05-21)

## Disclosures

- [CVE-2026-111952](https://moltenbit.net/security-research/#CVE-2026-111952): curl, Moderate, 2026-10-26. Cached CA store keeps `CURLOPT_CAPATH` certificates bound to a `CURLOPT_SSLENGINE` provider context freed with an earlier easy handle, letting a malicious server trigger a use-after-free during the next certificate verification.
- [cbioportal-getexternalpage-ssrf](https://moltenbit.net/security-research/#cbioportal-getexternalpage-ssrf): cBioPortal, High, 2026-10-22, No CVE. Unauthenticated `/api/getexternalpage.json` fetches any `sourceURL` without scheme or host checks, allowing SSRF and `file://` reads of local files such as `application.properties`.
- [CVE-2026-108448](https://moltenbit.net/security-research/#CVE-2026-108448): Microsoft Office Outlook, High (CVSS 7.5), 2026-10-15. Heap-based buffer overflow lets an unauthenticated remote attacker execute code over the network, with the Preview Pane as an attack vector.
- [CVE-2026-88156](https://moltenbit.net/security-research/#CVE-2026-88156): Microsoft Office Outlook, Critical (CVSS 9.8), 2026-10-13. Stack-based buffer overflow lets an unauthenticated remote attacker execute code when a crafted email is shown in the Reading Pane, without the recipient opening it.
- [CVE-2026-70343](https://moltenbit.net/security-research/#CVE-2026-70343): Microsoft MPEG-2 Video Extension, High (CVSS 8.8), 2026-10-13. Heap-based buffer overflow lets a crafted video file execute code in the context of the user who opens it.
- [CVE-2026-75804](https://moltenbit.net/security-research/#CVE-2026-75804): OpenSSL, Low, 2026-09-29. QUIC stack enforces the stream-level but not the connection-level flow control limit, letting a remote peer make one connection allocate about 100 MB of heap instead of the 768 KiB window.
- [CVE-2026-10627](https://moltenbit.net/security-research/#CVE-2026-10627): Events Manager WordPress Plugin, Moderate (CVSS 5.3), 2026-08-24. Missing authorization lets unauthenticated attackers use `status`, `private`, and `private_only` parameters to view draft, pending, trashed, or private event and location details.
- [CVE-2026-71540](https://moltenbit.net/security-research/#CVE-2026-71540): Wazuh, High (CVSS 7.5), 2026-08-18. Pre-authentication cluster header parsing lets one source IP allocate 256 MiB of manager memory per TCP connection.
- [CVE-2026-74046](https://moltenbit.net/security-research/#CVE-2026-74046): Wazuh, Moderate (CVSS 4.9), 2026-08-18. `zlib` decompression bomb in cluster archive processing lets an authenticated peer exhaust `wazuh-clusterd` memory.
- [CVE-2026-74044](https://moltenbit.net/security-research/#CVE-2026-74044): Wazuh, Moderate (CVSS 6.5), 2026-08-18. Peer-controlled cluster hello node name lets an authenticated peer delete the contents of arbitrary manager directories on disconnect.
- [CVE-2026-48024](https://moltenbit.net/security-research/#CVE-2026-48024): Wazuh, Critical (CVSS 9.1), 2026-08-07. Merged-file header path traversal in cluster sync allows a cluster peer to write arbitrary files under `WAZUH_PATH` and reach root code execution.
- [CVE-2026-48162](https://moltenbit.net/security-research/#CVE-2026-48162): Wazuh, Critical (CVSS 9.1), 2026-08-07. DAPI `tmp_file` path injection lets a cluster peer read arbitrary master files and forge REST API administrator tokens.
- [CVE-2026-49441](https://moltenbit.net/security-research/#CVE-2026-49441): Wazuh, Critical (CVSS 9.1), 2026-08-07. Peer-controlled metadata key in cluster sync allows arbitrary file writes under `WAZUH_PATH` and root code execution on the manager.
- [CVE-2026-46647](https://moltenbit.net/security-research/#CVE-2026-46647): GlobaLeaks, Low (CVSS 3.3), 2026-07-30. Insufficient role enforcement allows non-admin internal users on the root or management tenant to read and modify network configuration.
- [CVE-2026-46648](https://moltenbit.net/security-research/#CVE-2026-46648): GlobaLeaks, Moderate (CVSS 4.1), 2026-07-30. Incomplete tenant scoping lets a non-root tenant admin clear secondary escrow backup keys across all tenants.
- [vinext-i18n-middleware-auth-bypass](https://moltenbit.net/security-research/#vinext-i18n-middleware-auth-bypass): vinext, Moderate, 2026-07-23, No CVE. Authentication bypass via i18n locale prefix; middleware matcher evaluates unsanitized pathname.
- [vinext-middleware-header-sanitization-bypass](https://moltenbit.net/security-research/#vinext-middleware-header-sanitization-bypass): vinext, Low, 2026-07-23, No CVE. Middleware header sanitization bypass; missing `x-middleware-override-headers` allows header spoofing.
- [vinext-next-head-reflected-xss](https://moltenbit.net/security-research/#vinext-next-head-reflected-xss): vinext, Low, 2026-07-23, No CVE. Reflected XSS via unescaped attribute names in `next/head` SSR serializer.
- [CVE-2026-75524](https://moltenbit.net/security-research/#CVE-2026-75524): OpenReception, Moderate (CVSS 5.4), 2026-07-08. Race condition in appointment creation allows concurrent requests to create overlapping appointments for one agent.
- [CVE-2026-75525](https://moltenbit.net/security-research/#CVE-2026-75525): OpenReception, Moderate (CVSS 5.3), 2026-07-08. Unauthenticated ML-KEM key injection adds an attacker-controlled recipient to a tenant's staff-crypto directory.
- [CVE-2026-65825](https://moltenbit.net/security-research/#CVE-2026-65825): OpenReception, High (CVSS 7.5), 2026-07-03. One tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants.
- [CVE-2026-65824](https://moltenbit.net/security-research/#CVE-2026-65824): OpenReception, High (CVSS 7.4), 2026-07-03. Invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie.
- [CVE-2026-58418](https://moltenbit.net/security-research/#CVE-2026-58418): Gitea, Moderate (CVSS 6.5), 2026-07-01. SSRF via HTTP redirect in repository migration allows authenticated users to bypass internal address restrictions and reach localhost or private-network services.
- [CVE-2026-14285](https://moltenbit.net/security-research/#CVE-2026-14285): MiniUPnP, Moderate (CVSS 4.3), 2026-07-01. Heap over-read in UPnP event callback URL host parsing (`upnpevents.c`).
- [CVE-2026-56727](https://moltenbit.net/security-research/#CVE-2026-56727): Zammad, High (CVSS 7.1), 2026-06-17. PGP email verification handler discards GPG return values, falsely marking all inbound signed emails as valid signatures.
- [CVE-2026-56725](https://moltenbit.net/security-research/#CVE-2026-56725): Zammad, High (CVSS 8.7), 2026-06-17. Unauthenticated request to OTRS import controller endpoint blocks request workers for ~115 seconds, enabling denial of service.
- [CVE-2026-56724](https://moltenbit.net/security-research/#CVE-2026-56724): Zammad, High (CVSS 7.1), 2026-06-17. Knowledge base permission checks allow users with limited read permissions to access items outside their assigned scope.
- [CVE-2026-48088](https://moltenbit.net/security-research/#CVE-2026-48088): OpenReception, Critical (CVSS 9.4), 2026-05-20. Unauthenticated staff crypto poisoning breaks E2E recipient directory.
- [CVE-2026-48087](https://moltenbit.net/security-research/#CVE-2026-48087): OpenReception, Critical (CVSS 9.8), 2026-05-20. WebAuthn passkey injection allows account takeover.
- [CVE-2026-48086](https://moltenbit.net/security-research/#CVE-2026-48086): OpenReception, Critical (CVSS 9.9), 2026-05-20. Tenant admin self-promotes to `GLOBAL_ADMIN`.
- [CVE-2026-48085](https://moltenbit.net/security-research/#CVE-2026-48085): OpenReception, Critical (CVSS 9.8), 2026-05-20. Unauthenticated `GLOBAL_ADMIN` account creation post-bootstrap.
- [CVE-2026-48084](https://moltenbit.net/security-research/#CVE-2026-48084): OpenReception, High (CVSS 7.4), 2026-05-20. Passphrase login attempts are not rate-limited.
- [CVE-2026-48083](https://moltenbit.net/security-research/#CVE-2026-48083): OpenReception, Moderate (CVSS 6.5), 2026-05-20. Unauthenticated `POST /api/log` accepts arbitrary content with CRLF injection and no size or rate limits.
- [CVE-2026-48082](https://moltenbit.net/security-research/#CVE-2026-48082): OpenReception, Low (CVSS 3.7), 2026-05-20. Bootstrap challenge proof-of-work difficulty hardcoded to 16 bits enables abuse rate amplification.
- [CVE-2026-48081](https://moltenbit.net/security-research/#CVE-2026-48081): OpenReception, High (CVSS 8.1), 2026-05-20. Stored click-triggered XSS via `javascript:` tenant links rendered into patient-facing footer.
- [CVE-2026-48080](https://moltenbit.net/security-research/#CVE-2026-48080): OpenReception, High (CVSS 8.0), 2026-05-20. Tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment.
- [CVE-2026-48079](https://moltenbit.net/security-research/#CVE-2026-48079): OpenReception, High (CVSS 7.4), 2026-05-20. Logout page clears local `access_token` before server-side revocation, leaving duplicated tokens valid until expiry.
- [CVE-2026-48078](https://moltenbit.net/security-research/#CVE-2026-48078): OpenReception, Moderate (CVSS 5.3), 2026-05-20. Schedule endpoint discloses `isPublic=false` channels and slot availability to unauthenticated callers.
- [CVE-2026-48077](https://moltenbit.net/security-research/#CVE-2026-48077): OpenReception, Moderate (CVSS 5.3), 2026-05-20. GET appointment by ID returns full appointment record without authorization.
- [CVE-2026-48076](https://moltenbit.net/security-research/#CVE-2026-48076): OpenReception, Moderate (CVSS 6.5), 2026-05-20. Bootstrap booking flow allows unauthenticated booking on `isPublic=false` channels.
- [CVE-2026-48075](https://moltenbit.net/security-research/#CVE-2026-48075): OpenReception, Moderate (CVSS 6.5), 2026-05-20. Unauthenticated `add-to-tunnel` endpoint accepts arbitrary appointment injections.
- [CVE-2026-48074](https://moltenbit.net/security-research/#CVE-2026-48074): OpenReception, Low (CVSS 2.7), 2026-05-20. Staff deletion removes pending invites cross-tenant by email match.
- [CVE-2026-48071](https://moltenbit.net/security-research/#CVE-2026-48071): OpenReception, Moderate (CVSS 5.8), 2026-05-20. Client PIN challenge throttle is keyed by `emailHash` only, allowing cross-tenant lockout.
- [CVE-2026-6965](https://moltenbit.net/security-research/#CVE-2026-6965): Tutor LMS WordPress Plugin, Moderate (CVSS 5.3), 2026-05-12. Insecure direct object reference leading to authenticated arbitrary post deletion via `course` GET parameter.
- [hushline-fielddefinition-idor](https://moltenbit.net/security-research/#hushline-fielddefinition-idor): Hushline, High (CVSS 7.9), 2026-05-09, No CVE. IDOR in `FieldDefinition` lets authenticated users alter or destroy other users' submission fields and stored disclosure content.
- [hushline-session-rotation](https://moltenbit.net/security-research/#hushline-session-rotation): Hushline, High (CVSS 7.4), 2026-05-09, No CVE. In-app password change does not rotate `User.session_id`, contradicting the documented threat model.
- [CVE-2026-34782](https://moltenbit.net/security-research/#CVE-2026-34782): Zammad, Moderate (CVSS 5.3), 2026-04-08. Missing authorization in AI assistance controller for text tools.
- [CVE-2026-34837](https://moltenbit.net/security-research/#CVE-2026-34837): Zammad, Moderate (CVSS 5.3), 2026-04-08. Missing authorization in AI assistance controller for context data used in text tools.
- [CVE-2026-34721](https://moltenbit.net/security-research/#CVE-2026-34721): Zammad, Moderate (CVSS 5.9), 2026-04-08. Cross-site request forgery (CSRF) in OAuth callback endpoints.
- [msrc-acknowledgment-2026-03](https://moltenbit.net/security-research/#msrc-acknowledgment-2026-03): Microsoft Online Services, 2026-03-31, MSRC Acknowledgment. Vulnerability in Microsoft Online Services.
- [CVE-2025-30201](https://moltenbit.net/security-research/#CVE-2025-30201): Wazuh, High (CVSS 7.7), 2026-03-17. Bypass of UNC path mitigation in Windows OSQuery via \\\\?\\UNC\\.

## Pages

- [Privacy](https://moltenbit.net/privacy/index.md): This site does not use cookies, tracking scripts, or third-party resources. No data is shared with third parties.
- [Contact](https://moltenbit.net/contact/index.md): You can communicate with me via PGP encrypted mail.

## Optional

- [PGP key](https://moltenbit.net/pgp/moltenbit.asc): fingerprint `3FE5 6A85 DF1B C97C C570  276B B02E 49E4 AE1D EB00`
- [security.txt](https://moltenbit.net/.well-known/security.txt): how to report a vulnerability in this website or my GitHub repositories
- [RSS feed](https://moltenbit.net/index.xml): new writeups
- [GitHub](https://github.com/moltenbit)
- [Mastodon](https://infosec.exchange/@moltenbit)
- [Bluesky](https://bsky.app/profile/moltenbit.bsky.social)