Ping Identity · Report #724039
Google Maps API key leaked during device pairing
Summary
Summary: just on intercepting and going through the request i made from ort-admin.pingone.com . i found that the google map api key was leaking through get request . i was able to validate that the leaked key was a valid one
Steps To Reproduce: 1.login to account
goto setup tab > ping iD > device pairing goto add an ip and enter an ip click save and intercept the request have a look to the GET request and see the google map api key was leaked through request leaked key is █████
███
i was able to validate thatt this key was a valid one by using an endpoint that validate the key
this shows that this is a valid key
Impact any persons can use this api key for their own use
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.