Anees Hyder

WebDeveloper | Bugbounty Hunter | CVE-2026-25523

[Anees Hyder @aneesOx_dev]

7/7
How to fix it?Validation must happen on the Server Side. The server should receive the OTP, verify it against the database, and return a secure session token or cookie.
Stay curious, stay secure! 💻🔒 #infosec #bugbounty #webdev #javascript

[Anees Hyder @aneesOx_dev]

Why you should NEVER trust the client for sensitive logic.
1/7 🛡️ I was recently testing a web application and stumbled upon some jQuery logic handling OTP verification. Within minutes, I was able to completely bypass the authentication process.
Let’s break it down. 🧵👇

[Anees Hyder @aneesOx_dev]

6/7
The LessonClient-side validation is for User Experience (UX), not Security.
✅ Good: Checking if the OTP is the right length before sending.

❌ Bad: Letting the client-side code decide if the OTP is "correct" to proceed to sensitive areas.

[Anees Hyder @aneesOx_dev]

https://t.co/YaZBnS8rQi
https://t.co/NedFA9X9CK

[Anees Hyder @aneesOx_dev]

Just got my first CVE from a HackerOne report - CVE-2026-25523
Grateful to be contributing to real-world security in open-source software. More coming. 💻🔐

#cve #hackerone #cybersecurity #BugBounty

[Behi @Behi_Sec]

7 bug bounty tips I wish someone had told me when I started: 🧵

[Next.js @nextjs]

Update on CVE-2025-66478 (React2Shell):

An npm package has been released to scan and update affected Next.js apps. Use `npx fix-react2shell-next` to update to patched versions.

All users should update as soon as possible.

More details our blog:

https://t.co/fjNfpv3huI

[Anees Hyder @aneesOx_dev]

Its up again !

[Anees Hyder @aneesOx_dev]

https://t.co/NnRlKAmnjm down?

@Hacker0x01

[Anees Hyder @aneesOx_dev]

Seems like cloudflare again !

[Anees Hyder @aneesOx_dev]

Duplicate? That means you’re on the right track!

#CyberSecurity #BugBounty

[Anees Hyder @aneesOx_dev]

Helped in securing a credit card website.

#CyberSecurity #bugbounty

[Anees Hyder @aneesOx_dev]

Persistence is the key

[Hajjaj 🇵🇸 @Hajjaj0x]

80% never even start. 10% quit halfway. Only 10% make it to the end. Choose your side.

[Anees Hyder @aneesOx_dev]

My first report at @Hacker0x01
CORS misconfiguration lead to Authorization bypass

#cybersecurity #bugbounty

[Anees Hyder @aneesOx_dev]

@AghariaTausif @flipkartsupport @Flipkart I had some bad experiences with Flipkart recently. It was about cancelling my order. I had to try multiple times to just cancel my order which should be pretty easy to do. At last they told me to cancel my order when the delivery guy comes to me.