CVE analyses and vulnerability writeups: how each vulnerability works, how attackers will use it, and what to do about it—in plain language, with the technical depth to back it up.
New writeups land here when a CVE is worth the depth. Subscribe via RSS
A single HTTP header let attackers skip Next.js middleware entirely—bypassing authentication on every route it guarded. Why the vulnerable code looked perfectly reasonable, and what it teaches about trust boundaries.
Read the writeupTwo messages and your code runs—before authentication. The auth state was handed to the decision point and deliberately discarded. A pure state-machine flaw, and the one-line grep that would have found it.
Read the writeupA spoofed header, a validator that argued with itself, and a stolen machine key that kept attackers inside after the patch landed. Why remediation order decided who actually recovered.
Read the writeupThe same operators who write these breakdowns run our engagements. Tell us your scope and we'll respond within 24 hours—under NDA, on a secure channel.
All communications encrypted · NDA available · Free retest included · Response within 24h