地图 / Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect

Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect

身份认证 / Missing Authentication for Critical Function / #3966599

厂商: AWS VDP
严重程度: 低危
赏金: —
弱点: Missing Authentication for Critical Function
研究员: @notnotnotveg
披露日期: 2026-10-16
资产: *.aws.dev
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2471 字符中的一小部分）

**Description:** The unauthenticated go-httpbin instance exposes multiple endpoints that accept attacker-controlled input without appropriate validation.

原文中的代码

████████
████████
████████

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 AWS VDP 所有。

时间线

2026-08-24报告提交
2026-10-16公开披露

阅读 HackerOne 原文 ↗作者 @notnotnotveg · 版权归作者与 AWS VDP 所有

同类报告

Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordPayPal · 2020-01-08 · $15,300 [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMail.ru · —Authentication bypass for ███ leads to take over any users account.Krisp · 2022-10-31 Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadataShopify · 2026-11-03 · $3,100 Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor dataEssity · 2026-10-14 Administration page visible without authenticationVisma Public · — · $100