// WRITE-UPS & ADVISORIES
Showing all write-ups
CVE-2026-104056: Authlib 1.7.2 OAuth/OIDC Discovery Trust Boundary Bypass
Authlib's OAuth2/OIDC client integrations (baseclient, flaskclient, starletteclient, httpxclient) cache the contents of a .well-known OpenID Connect discovery document...
CVE-2026-96760: Authlib 1.7.2 - Signature Verification Bypass: General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
authlib.jose's JsonWebSignature.deserializejson() treats a JWS with an empty signatures array as successfully verified - no key required, no signature checked. Any...
HackTheBox - vvm: ELF 64-bit LSB PIE Executable (x86_64) & Custom Stack-Based Virtual Machine (VM) with Self-Decrypting Handlers
--- The vvm challenge from HackTheBox features a proprietary client-side password validation engine protected by a custom, stack-based Virtual Machine (VM). The...
HackTheBox - NestGuard Breach: ESP32 XOR-Decoded MQTT Identity to Retained $debug Topic Leak
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - Space Ops: Raw SDR Modem to Spacecraft Command-and-Telemetry Exchange
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - Blinded: Leakless glibc 2.35 Tcache Overlap to ld.so SYMTAB Hijack
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - Callfuscated: Defeating Call-Threaded Instruction Slicing & MBA-Hardened Stack VMs
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - TrustFall: Multi-Stage Exploitation From Public Attack Surface to Complete Domain Compromise in a Hardened Enterprise
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - Sandcastle: Reverse Engineering a Multi-Process Bytecode VM & IPC Sandbox Escape
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
HackTheBox - ZaZamarin: Unboxing a .NET MAUI Android CTF Through Native Emulation
CLASSIFIED ADVISORY // RESTRICTED ACCESS. This research document is encrypted with AES-256-GCM. Authorization credentials are required to decrypt.
CVE-2026-88899: Knowns 0.30.0 - Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem
Verified. An improper authorization and header-spoofing vulnerability exists in Knowns' reverse proxy for the embedded OpenCode AI agent daemon (server.go:1249-1305)....
CVE-2026-86543: Knowns 0.29.1 - Insecure Default Configuration leads to Unauthenticated Management API Exposure on All Interfaces
Verified by Nguyen Huy Hoang (hoanggxyuuki) & Tong Hoang Gia (uziii2208). The default deployment of the Knowns browser server operates in a fully unauthenticated state,...
CVE-2026-86259: OpenMAIC 1.0.0 - Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass
Verified. A two-leg exploit chain exists in OpenMAIC's authentication middleware and outbound provider request layer that allows an unauthenticated remote attacker to...
HackTheBox - Sorcery: Cypher Injection, Kafka SSRF to RCE & FreeIPA Privilege Escalation
Sorcery is a Linux box with a Rust Rocket web app backed by Neo4j, Gitea, and a Kafka message bus. I’ll exploit Cypher injection in a derive-macro-generated query to...
HackTheBox - Reaper: Format String ASLR Leak, VirtualAlloc ROP Chain, DPAPI Decryption & Kernel Token Stealing
Reaper is an Insane-difficulty Windows target on HackTheBox that tests the full spectrum of modern offensive security engineering-bridging userland reverse engineering,...
HackTheBox - Hercules: Active Directory, Kerberos Delegation & LDAP Injection Walkthrough
Hercules is an Insane-difficulty Windows machine that requires extensive knowledge of Active Directory attacks and Kerberos authentication. The domain has NTLM disabled,...