Rejected as OOS. Race condition on a payment gateway. Cancel + pay concurrently, both succeed. Three pay requests, three charges. Session state machine is the authorization. They said it wasnt.
#bugbounty#websecurity
Hey @yeswehack, could someone from the team please take a second look at report #YWH-PGM13651-454? It's been 9 days since my last comment with no response. Just looking for a fair technical review.
Spent 3 days chaining an SSRF. Confirmed OOB, built a redirect server through Serveo, got their client to follow 302s all the way to cloud metadata. IAM credentials territory.
Duplicate. Someone found it a month ago.
#bugbounty#ssrf