TOPIC

#web

2 articles

Critical · Published20 Aug 2026

How to pwn a website and take over any account

How a broken password-reset flow exposed recovery secrets to unauthenticated users and turned account recovery into a complete account-takeover primitive.

WebAPIAuthenticationAccount TakeoverPassword ResetInformation Disclosure

13 min read

High · Published19 Aug 2026

Cross-Session Session Leakage Through Cached Next.js Responses

How a shared CloudFront cache exposed an HttpOnly session credential embedded in server-rendered Next.js responses.

WebNext.jsCloudFrontSession ManagementCDNInformation Disclosure

11 min read