Coinbase · Report #100829
Stored-XSS in https://www.coinbase.com/
Validstatus
13upvotes
7 Dec 2015disclosed
Summary
Coinbase was mistakenly allowing developers to set their website or developer URL to a javascript:// or data:// URL.
This link would then be rendered into the OAuth authorization page and leave users vulnerable to XSS if they clicked on it.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.