HexBrain

Bykea · Report #3328343

Lack of minimum value bid wheel verification on customer_bid in Rental Trips

Validstatus
lowseverity
55upvotes
20 Nov 2025disclosed

Summary

A missing validation on the customer_bid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. While drivers would not have accepted such low-balled offers, the system displayed these manipulated fare trips without verification. Proper validation is now added to prevent unrealistic values.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original