Valve · Report #1079561
Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)
Validstatus
highseverity
60upvotes
21 Sept 2021disclosed
Summary
Researcher reported an issue where certain secure cookies would be included in a web request initiated through Steam Big Picture mode that was initially to a trusted origin but subsequently forwarded to a site on a different origin.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.