HexBrain

Alohi · Report #1494308

Waitlist bypass for accessing SIGN.PLUS Beta

Validstatus
lowseverity
11upvotes
30 May 2022disclosed

Summary

During SIGN.PLUS beta phase, it was found out that hackers could trick the API response and pretend to have been accepted into the beta program. All server operations would be blocked, but the UI client would be accessible, exposing the work-in-progress design to non-beta users. There was no consequence as SIGN.PLUS was to be released to the public a couple of days later.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original