nadler // security research

How a body-supplied clientId, an attacker-directed OTP, and a login-error identifier leak chained into a zero-click account takeover.

recon since i can’t disclose the program let’s call it target.com. the app had a lot of functionality, and reading the js files was the move to understand those functions and find hidden endpoints. while analyzing the bundles i hit a really interesting bl…