Start protecting my application
Case studies

Real vulnerabilities. Real evidence. Real fixes.

Every case study comes from a delivered Zentinel assessment. Customer identities, targets, payloads and data are redacted. Where a stage of the timeline is not marked, it has not been published for that case.

Showing 7 case studies

criticalCVSS 9.1

Signup form that reset anyone's password.

Re-registering an existing user's email allowed an attacker to take over the account.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (complete)
  4. Retested (complete)
Read the case study
criticalCVSS 10.0

Unauthenticated remote code execution.

A public-facing application accepted crafted input that resulted in server-side command execution.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study
criticalCVSS 10.0

Exposed BI tool with unauthenticated SQL injection.

An internal analytics instance was reachable from the public internet and exposed a path to sensitive company data.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study
critical

OAuth redirect bypass to full account takeover.

Loose redirect URI matching let a crafted login link hand a user's authorization code to an attacker.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study
criticalfound in 3 assessments

Unauthenticated SSRF reaching cloud metadata.

Endpoints that fetch a user-supplied URL could be pointed at the cloud provider's internal metadata service.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study
highfound in 2 assessments

Dangling subdomain harvesting live user tokens.

A DNS record pointing at a deleted hosting project could be claimed by anyone, and session cookies were scoped to it.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study
highfound in 2 assessments

Row-level security never switched on.

New tables shipped without row-level security, readable by anyone holding the public client key.

  1. Discovered (complete)
  2. Proven (complete)
  3. Fixed (not yet published)
  4. Retested (not yet published)
Read the case study

Your application keeps changing.
Your security should keep testing.

Put your application into the Zentinel loop.

Start protecting my application

Authorized testing only. All testing occurs within agreed scope and rules of engagement.