Valve · Report #674800
/applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API key
Validstatus
highseverity
30upvotes
30 Jul 2024disclosed
Summary
Insufficient validation of parameters enabled using path traversal to call arbitrary API methods using an API key that had elevated privileges for Dota2.
.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.