Anonymous

[Anonymous @B_D3aTH]

Yes, it’s not working because the JWT on site B is properly secured with a signature.
But here’s what I did:

I decompiled the APK and examined the authentication logic. I discovered that the app uses a different API endpoint and a different authentication workflow, where it adds a header similar to:

Authorization: Token token=<same token format>

After that, I intercepted the requests from the APK—but it took me almost a week because the app is heavily protected with:

Anti-debugging

Anti-root

Anti-Frida

SSL pinning

Using my bypass method, I was eventually able to intercept the traffic and successfully achieve another account takeover by reusing the JWT from site B.

I’m now waiting for the triage team to review it, since they’re having trouble bypassing the APK’s security mechanisms.

[Anonymous @B_D3aTH]

Another critical 🎯
0-click account takeover by cross-site JWT reuse

While reviewing the auth flows across multiple domains in scope, I noticed something serious:

Site A sets a simple token in a cookie (jwt=abc123…)

Site B uses a full JWT in the Authorization header — the classic 3-part token (header.payload.signature), fully decodable and containing auth data inside it.

When I decoded the JWT from Site B, I found it includes an auth header value identical to Site A’s format.

So I registered an email on Site B that already exists on Site A → backend generated a valid JWT for the victim’s email.

Then on Site A, I logged in with my attacker account, intercepted the login response, and swapped my JWT with the victim’s JWT created on Site B. I forwarded the response and…
💥 I was instantly logged into the victim’s account with full functionality — zero interaction required.

Messy chain, but extremely effective.

Happy hunting 👾🔥

#BugBounty #bugbountytip #bugbountytips #CyberSec

[Anonymous @B_D3aTH]

@Meldenftn @baraa_mansi Yes

[Anonymous @B_D3aTH]

@1mohdfarhaan_ Thank u 💓

[Anonymous @B_D3aTH]

@choz3nexe Thank u

[Anonymous @B_D3aTH]

@TheTySiah &lt;3

[Anonymous @B_D3aTH]

@Mikkyboy150 welcome

[Anonymous @B_D3aTH]

@e_n4tsu read this :
https://t.co/BmpQm6Fiw6

[Anonymous @B_D3aTH]

There is no email verification on either Site A or Site B.
During reconnaissance on Site A, I observed that the authentication cookie uses a very short 20-character JWT-like token (3Xww67hjy1AH4eWmcyck). It cannot realistically be brute-forced, and there is no endpoint that exposes or leaks this token.
While testing Site B, I noticed that it uses a full JWT (header, payload, signature). After decoding the payload, I found something critical:

{
"authToken": "4Xww67hjy1AH4emWcyCk",
"emailDomain": "https://t.co/sEZ9emncds"
}

This means Site B embeds the authToken inside the JWT payload.
I then registered an email on Site B that already exists on Site A, which caused Site B to generate a new token for that email.
Using this generated token from Site B on Site A successfully allowed me to take over an existing account that was already registered on Site A.

[Anonymous @B_D3aTH]

@wolveylx thank u &lt;3

[Anonymous @B_D3aTH]

@gabbytech01 thanks :)

[Anonymous @B_D3aTH]

@AatankBadb16659 thanks &lt;3

[Anonymous @B_D3aTH]

@khaled_hunter93 thank u

[Anonymous @B_D3aTH]

@0xAbady tthank u bro.

[Anonymous @B_D3aTH]

There is no email verification on either Site A or Site B.
During reconnaissance on Site A, I observed that the authentication cookie uses a very short 20-character JWT-like token (3Xww67hjy1AH4eWmcyck). It cannot realistically be brute-forced, and there is no endpoint that exposes or leaks this token.
While testing Site B, I noticed that it uses a full JWT (header, payload, signature). After decoding the payload, I found something critical:

{
"authToken": "4Xww67hjy1AH4emWcyCk",
"emailDomain": "https://t.co/sEZ9emncds"
}

This means Site B embeds the authToken inside the JWT payload.
I then registered an email on Site B that already exists on Site A, which caused Site B to generate a new token for that email.
Using this generated token from Site B on Site A successfully allowed me to take over an existing account that was already registered on Site A.

[Anonymous @B_D3aTH]

@baraa_mansi Yes an there is no signature for the jwt on the site A :) and it does not vludate the response a lot of issues 🙄

[Anonymous @B_D3aTH]

@0xyush4 الحتة دي عمرها ما جتلي الا بعديها
Need more info ==&gt; crtictal 💪

[Anonymous @B_D3aTH]

@one33se7en cong. can u share the payload ?