Bykea · Report #3328343
Lack of minimum value bid wheel verification on customer_bid in Rental Trips
Validstatus
lowseverity
55upvotes
20 Nov 2025disclosed
Summary
A missing validation on the customer_bid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. While drivers would not have accepted such low-balled offers, the system displayed these manipulated fare trips without verification. Proper validation is now added to prevent unrealistic values.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.