Cloudflare Public Bug Bounty · Report #1633231
Completely remove VPN profile from locked WARP iOS cient.
Validstatus
highseverity
$1,000bounty
21upvotes
7 Nov 2022disclosed
Summary
It was possible for a user to delete VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restriction enforced for enrolled devices by the Zero Trust platform. The issue was fixed in Warp iOS mobile client v. 6.15.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.