1. Executive Summary Vulnerability: Broken Brute-Force Protection (JSON Array Injection). Description: The application accepts authentication credentials via JSON. While it likely implements rate...

1. Executive Summary Vulnerability: Information Disclosure via Account Lock Logic. Description: The application implements account locking to prevent brute-forcing. However, the system verifies t...

1. Executive Summary Vulnerability: Broken Brute-Force Protection (Counter Reset Logic Flaw). Description: The application implements a “strike system” where too many failed login attempts result...

1. Executive Summary Vulnerability: Username Enumeration via Response Timing. Description: The application processes login attempts sequentially: first, it checks if the username exists; second, ...

1. Executive Summary Vulnerability: Username Enumeration (via Subtle Textual Differences). Description: The application attempts to prevent enumeration by using the same error message (“Invalid u...

1. Executive Summary Vulnerability: Username Enumeration (via Verbose Error Messages). Description: The application provides different error messages depending on whether a submitted username exi...

1. Executive Summary Vulnerability: Cross-Site WebSocket Hijacking (CSWSH). Description: The application’s WebSocket handshake relies solely on HTTP cookies for session handling and lacks CSRF pr...

1. Executive Summary Vulnerability: XSS Filter Bypass & IP Ban Circumvention (via Handshake Manipulation). Description: The application employs a Web Application Firewall (WAF) or server-side...

1. Executive Summary Vulnerability: Client-Side Bypassed Cross-Site Scripting (XSS) via WebSockets. Description: The application implements a live chat feature using the WebSocket protocol. While ...

1. Executive Summary Vulnerability: Broken Access Control (Insecure Header Validation). Description: The application attempts to verify authorization by checking the HTTP Referer header. It assum...