Redis replication state changes invalidated an active interpreter
Wiz confirms a USD 30,000 individual competition award for Yoni Sherez’s Redis entry, identified as CVE-2026-23631.
USD 30,000competition awardRead
BLVulnerability family
Business logic and concurrency.
State transitions, approval integrity, and transactional invariants. 14 disclosures · 34 related references · 4 diagrams.
Connected collection
Disclosures
Cloud Build approval was not bound to immutable code
A researcher-reported USD 30,000 award illustrates a gap between approval of a contribution and selection of the code executed.
USD 30,000reported awardRead
Instagram embedding fallback changed the authorization context
The researcher documents USD 14,500 for one report: a 10,000 base bounty and two event bonuses.
USD 14,500reported awardRead
Meta account verification weakened linked SMS authentication state
Meta confirms a USD 27,200 total award for this account-verification report.
USD 27,200reported awardRead
Pixel lock-screen completion lost security-state binding
A researcher-published vendor decision documents a USD 70,000 award for CVE-2022-20465.
USD 70,000reported awardRead
GitHub Actions trust depended on invalid repository references
A reference-validation flaw crossed the GitHub Actions trust boundary and earned USD 25,000.
USD 25,000reported awardRead
GitHub GraphQL collaboration changes lacked author consent
The second fork-collaboration report received its own USD 10,000 award.
USD 10,000reported awardRead
GitHub fork collaboration applied inconsistent authorization
The first fork-collaboration finding in this article earned USD 20,000.
USD 20,000reported awardRead
Microsoft account recovery lacked consistent attempt-limit enforcement
The cited researcher documents a USD 50,000 award for this finding.
USD 50,000reported awardRead
GitHub OAuth consent failed across request-method semantics
A USD 25,000 researcher-reported award illustrates how differing framework and controller assumptions can remove an OAuth consent boundary.
USD 25,000reported awardRead
Instagram recovery challenges were insufficiently bound to accounts
The researcher reports a $10,000 award for this finding. USD is a contextual currency inference from Facebook’s later official retrospective of its 2019 bounty program, not an explicit denomination in the individual…
USD 10,000reported awardRead
Instagram mobile account recovery had inconsistent verification limits
The cited researcher documents a USD 30,000 award for this finding.
USD 30,000reported awardRead
Shopify automatic account conversion lost merchant-consent binding
Shopify confirms a $20,000 award for unauthorized collaborator access caused by automatic account conversion.
USD 20,000reported awardRead
iCloud sharing consent and Safari trust boundaries failed together
The cited researcher documents a USD 100,500 award for this reported chain.
USD 100,500reported awardRead
Connected collection
Related learning
Better Auth: single-use authorization requires atomic state consumption
The maintainer disclosure for CVE-2026-53518 identifies separated reading and deletion of a single-use OAuth authorization record. Under concurrent processing, multiple successful consumers could receive independent…
Reviewed 2026-10-03Read
Bugsink: time-unit consistency in account-access token expiry
GHSA-4f45-qmjf-82cv describes account-access links whose configured seconds were interpreted as days. The maintainer reports unused email-verification, password-reset and new-user setup tokens surviving their intended…
Reviewed 2026-10-03Read
Coder: privileged provisioning must preserve existing object ownership
CVE-2026-55429 concerns a provisioning update-or-insert operation that could change an existing workspace application’s ownership relationship without checking the existing workspace. The maintainer describes potential…
Reviewed 2026-10-03Read
Directus: denied mutations must leave dependent state unchanged
GHSA-p623-wgx3-wxp8 describes service overrides committing cleanup before their superclass checked permission. Rejected mutations could therefore disconnect automation links, remove attribution metadata or invalidate…
Reviewed 2026-10-03Read
File Browser: existing shares must follow current owner permissions
GHSA-v9w4-gm2x-6rvf describes public file-sharing authority outliving its owner's permissions. Creating a share required sharing and download rights, but subsequent public access did not revalidate those rights. The…
Reviewed 2026-10-03Read
Google long-running operations: cancellation requests and completion evidence
Google's approved long-running-operation guidance separates failures before work starts from failures during execution. Its linked Operation contract distinguishes best-effort cancellation, terminal outcomes and…
Reviewed 2026-10-04Read
Google API request identity: bind retry semantics to the logical operation
Google's Approved request-identification guidance makes supplied IDs an idempotency contract with service-defined retention. Duplicates should receive the prior success response; a documented exception permits current…
Reviewed 2026-10-04Read
Google API field masks: preserve server-owned and immutable state
Google's Approved field-mask guidance defines which resource fields participate in an update. Services must ignore output-only input whether selected directly or through a containing field. Supporting field-behavior…
Reviewed 2026-10-04Read
Grav API: account-disable enforcement across session authenticators
GHSA-7qfj-82q8-frw6 describes inconsistent account-disable enforcement across authentication methods. Existing browser or remembered sessions could retain API authority because refreshed permissions did not also…
Reviewed 2026-10-04Read
HotCRP: separate submission visibility from authorship authority
GHSA-v8jx-vq6p-jq52 describes an API permission gap between viewing a submission and changing contact authorship. The maintainer reports that reviewers and program-committee members could obtain author-level access to…
Reviewed 2026-10-03Read
Microsoft compensating transactions: recovery must preserve valid concurrent state
Explains recovery after partial completion across services or data stores. Compensation applies domain-specific corrective effects; restoring an earlier snapshot can overwrite valid concurrent changes. Recovery can…
Reviewed 2026-10-04Read
Microsoft Graph batching: preserve each member authorization outcome
Microsoft Graph documentation distinguishes batch-envelope success from individual outcomes. Its example includes permission denials inside a successful batch response. Member results can arrive in a different order and…
Reviewed 2026-10-04Read
MythicalDash: payment evidence must establish credit entitlement
GHSA-qmh4-5v7g-42jq concerns pending payment state being accepted as authority to grant account credit before provider-confirmed settlement. The account update was atomic, but that concurrency property did not establish…
Reviewed 2026-10-04Read
n8n: directory-attribute authority in durable account linking
CVE-2026-33665 describes local-account linkage that trusted a matching LDAP email attribute. The maintainer reports persistent access to the linked account, including administrator authority, even after the directory…
Reviewed 2026-10-03Read
n8n: refreshed authority must remain bound to the consented resource
The maintainer reports that initial OAuth authorization preserved resource-specific consent, while refresh grants checked registration without preserving that binding. A client could consequently receive authority over…
Reviewed 2026-10-03Read
OpenFGA: policy intersections must preserve explicit exclusions
CVE-2026-61709 describes incorrect authorization-policy evaluation in user enumeration. Under a particular composition of wildcard membership, exclusion and intersection, a user denied by one policy component could…
Reviewed 2026-10-03Read
OpenFGA query consistency: authorization decisions need sufficiently fresh state
Authorization correctness includes the age of relationship state used for a decision. OpenFGA documents a latency-oriented mode that can reuse cached results and a higher-consistency mode that bypasses the cache. With…
Reviewed 2026-10-03Read
Outline: integration authority must end with its owning account
GHSA-33jq-x32c-3ccw describes webhook authority surviving deletion of its creator. Account cleanup omitted webhook subscriptions, while delivery trusted their enabled state. The maintainer-published report describes a…
Reviewed 2026-10-03Read
OWASP Forgot Password
Explains account-bound recovery challenges, limited lifetime and reuse, consistent responses, attempt controls, notifications and post-reset session handling.
Reviewed 2026-10-02Read
Authorization Cheat Sheet
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
Reviewed 2026-10-02Read
OWASP Secure Code Review: baseline and change-focused review
Explains how whole-codebase reviews and change-focused reviews answer different assurance questions. Connects architecture, business requirements and existing findings to manual examination of data movement, control…
Reviewed 2026-10-03Read
OWASP Threat Modeling: system assumptions and mitigation validation
Presents an iterative design-review process linking a system model to potential threats, agreed responses and validation. Data-flow diagrams expose trust boundaries and dependencies; structured prompts help identify…
Reviewed 2026-10-03Read
OWASP Transaction Authorization
Explains operation-specific approval: show significant transaction details, preserve authorized data, enforce valid state transitions and recheck authorization at execution.
Reviewed 2026-10-02Read
Paymenter: refund entitlement and ledger changes need one atomic transition
The maintainer traces duplicate downgrade credits to an eligibility check separated from the later balance change, without transactional isolation. A pending-operation guard did not protect the whole transition. The…
Reviewed 2026-10-03Read
PostgreSQL 18: Transaction Isolation and Business Invariants
Explains why a stable database snapshot alone does not preserve business rules across concurrent transactions. PostgreSQL distinguishes serializable consistency from explicit locking and requires serialization-failure…
Reviewed 2026-10-03Read
Pterodactyl: delegated tokens must preserve action-specific authority
GHSA-8r6w-3qq5-4p4r describes an authorization mismatch between the Panel and Wings. Tokens established an authenticated user and server context without adequately separating operation purpose. The maintainer-published…
Reviewed 2026-10-03Read
RFC 9700: Best Current Practice for OAuth 2.0 Security
Consensus guidance updating OAuth's security model with deployment experience, stronger protocol requirements, and deprecated insecure patterns. A primary reference for identity integration reviews.
Reviewed 2026-10-02Read
Spree: cart association must retain guest-possession checks
CVE-2026-94462 concerns a guest-cart ownership transition that required a signed-in customer but omitted the cart-possession check enforced by sibling operations. Account authentication and object lookup were treated as…
Reviewed 2026-10-03Read
Stripe webhooks: authentic delivery and business-state integrity
Stripe documents duplicate deliveries, unordered events and renewed signatures and timestamps on retries. Signature verification establishes delivery authenticity; it does not establish that the business effect is new…
Reviewed 2026-10-03Read
Sylius: order ownership does not confer payment-operation authority
The advisory distinguishes ownership of an order from authority over its payment operations. Customer-context requests were constrained by ownership but not by operation. A connected payment provider could therefore…
Reviewed 2026-10-03Read
Sylius: promotion entitlement must be checked and consumed atomically
Promotion eligibility used stale in-memory counts, while consumption was persisted later without synchronization. Absolute counter writes could also lose concurrent updates. The failed boundary was between a provisional…
Reviewed 2026-10-03Read
Vendure: payment child objects must inherit order channel authority
Order-level scoping did not carry into globally loaded payment, refund and fulfillment objects. A channel-limited administrator could affect another channel through child-object operations. The advisory contrasts scoped…
Reviewed 2026-10-03Read
Vikunja: saved favorites must recheck current project access
GHSA-jp29-jrxc-92vf describes a task-search branch that trusted a saved favorite without checking current project access. Favorite records survived share revocation, allowing previously authorized collaborators to keep…
Reviewed 2026-10-03Read
Vvveb: numeric input validity does not establish legitimate order state
CVE-2026-44826 concerns missing domain constraints between cart quantities and authoritative orders. Arithmetic propagated invalid purchase state through totals and checkout. The maintainer-published report describes a…
Reviewed 2026-10-04Read
Connected collection
Visual models
Recovery must preserve account ownership
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Approval stays attached to the reviewed version
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Fallbacks must preserve the original caller's authority
Original editorial defensive synthesis of the Instagram embedding disclosure and OWASP authorization guidance. The researcher attributes the disclosure to error handling that retrieved protected content under an…
Reviewed 2026-10-04Read
An identity claim must belong to the user
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software