Collected research

Bypassing CSP with New Relic Custom Events

Justin Gardner · Critical Thinking - Bug Bounty Podcast · 31 October 2025

A goto parameter redirected the POST carrying a victim's login token, and the site's strict policy still permitted New Relic's beacon host. Sending the JSON body to New Relic's event API stored it as an error record readable through their GraphQL API, so the token could be recovered and traded for a session cookie for full account takeover.

Record

Researcher

Justin Gardner

Published by

Critical Thinking - Bug Bounty Podcast

Date

31 October 2025

Topic

XSS

In the archive

• Collected in the 2025 research round

Tags

• csp
• oauth
• info-leak
• graphql
• auth-bypass
• attack-chain
• bug-bounty
• open-redirect
• owasp-a01-2021
• owasp-a04-2021
• owasp-a05-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Justin Gardner, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.