POJIA破甲
地图 / Leaked reused password for a few Khan Academy users

Leaked reused password for a few Khan Academy users

信息泄露 / 敏感信息明文存储 / #3099978

厂商
Khan Academy
严重程度
中危
赏金
—
弱点
敏感信息明文存储
研究员
@a0xtrojan
披露日期
2025-07-12
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(937 字符中的一小部分)
I found A lot of credentials for your domain on the Telegram bot: ███ While the exact sources of the leaked data are unknown, the volume of exposed information is substantial. This report is submitted for your review to assess and mitigate the exposure of user credentials, including emails and …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Khan Academy 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @a0xtrojan · 版权归作者与 Khan Academy 所有

同类报告

Github Token Leaked publicly for https://github.sc-corp.netSnapchat · 2018-10-08Public and secret api key leaked in JavaScript sourceStripo Inc · 2020-09-29Slack token leaking in stackoverflow and devtimesShipt · — · $300Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Khan Academy · 2025-05-07internal dev tokens disclosureSnapchat · 2023-06-14 · $250Github Token Leaked publicly for https://github.com/mopubX / xAI · 2019-08-15