Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| curl cookie mixed case PSL bypass | No account | No object involved | A server-set cookie bypassed the public-suffix boundary and was sent to unrelated origins. |
| CVE-2023-46218: cookie mixed case PSL bypass | A user account | No object involved | Cookie scope protection was bypassed, allowing a cookie set by one site to be sent to other sites under the same public suffix. |
| CVE-2022-27779: cookie for trailing dot TLD | A user account | No object involved | A cookie set by one site was scoped broadly enough to be sent to an unrelated site. |
| CVE-2026-3783: token leak with redirect and netrc | A user account | No object involved | A bearer token intended for the original host is sent to a different redirect destination. |
| Google Maps API key leaked during device pairing | A user account | No object involved | A logged-in user could obtain an application API key through the device-pairing request. |
| CVE-2026-6429: netrc credential leak with reused proxy connection | A user account | No object involved | Credentials for one host were sent as host Authorization to different redirected hosts. |