Preliminary research
CargoWise WebTracker — The Keys Were in the Cargo
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Follows hardcoded encryption keys into CargoWise auto-login tokens and a fallback identity. Handler endpoints bypass page-level session teardown, enabling contact enumeration and persistent sessions that expose shipment and document data. The writeup also discusses a known-machine-key ViewState route.
Record
- Researcher
- Patrik Grobshäuser, Shubham Shah, Adam Kues and Dylan Pindur
- Published by
- Searchlight Cyber
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Patrik Grobshäuser, Shubham Shah, Adam Kues and Dylan Pindur, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .