POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
该报告还没有中文解读。
原文摘录
摘自原文（7850 字符中的一小部分）
The `POST /api/bitcoinWithdrawalFees` endpoint returns real-time Bitcoin withdrawal fee data **without requiring any authentication**, despite being explicitly documented as a **"USER OPERATION"** (private endpoint) in the [official CoinMate API …
原文中的代码
## Bitcoin withdrawal fees [/bitcoinWithdrawalFees]
**USER OPERATION**
### POST [POST]
+ Request (application/x-www-form-urlencoded)
clientId=1038&nonce=15270794730&signature=94933BF157B9405A1C2F330902987300B3A73DE620023E1782635AAF16984729默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 CoinMate.io 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @glferreira-devsecops · 版权归作者与 CoinMate.io 所有