Dangling subdomain harvesting live user tokens.
A DNS record pointing at a deleted hosting project could be claimed by anyone, and session cookies were scoped to it.
- Discovered (complete)
- Proven (complete)
- Fixed (not yet published)
- Retested (not yet published)
What they were shipping
A marketing site and a B2B SaaS product on the same parent domain.
What we found
A production DNS record still pointed at a hosting service the team had stopped using: a deleted container, an unlinked project. The name was free for anyone to claim.
How we proved it
We confirmed the target resource was unclaimed and that session cookies were scoped to the parent domain, so the orphaned subdomain would receive them.
Business impact
Whoever registered the orphaned subdomain would passively receive live customer session tokens. Cost to the attacker: a few dollars.
Fix
Remove DNS records before deleting the resource they point to, and scope session cookies to the exact host that needs them.
Retest
Retest status not published for this case.
Why it keeps happening
Fast teams tear down staging and switch providers constantly, and the DNS never gets scrubbed. Nothing in your app looks broken while this is happening.