Preliminary research
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Client-side path traversal reroutes an authenticated invite request to change an account email, enabling password reset. The author then reports a 2FA bypass using __proto__ as the code and explains a possible inherited-property lookup cause, related lookup patterns and repairs.
Record
- Researcher
- whoareme
- Published by
- whoareme.com
- Date
- Topic
- XSS
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of whoareme, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .