Alohi · Report #1494308
Waitlist bypass for accessing SIGN.PLUS Beta
Validstatus
lowseverity
11upvotes
30 May 2022disclosed
Summary
During SIGN.PLUS beta phase, it was found out that hackers could trick the API response and pretend to have been accepted into the beta program. All server operations would be blocked, but the UI client would be accessible, exposing the work-in-progress design to non-beta users. There was no consequence as SIGN.PLUS was to be released to the public a couple of days later.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.