Breakdowns of findings from bug bounty programs and private research. I publish after the vendor ships a fix and the program clears me to talk. Nothing here is live.
An encoding bypass on a redirect endpoint plus a non-HttpOnly session cookie let one crafted link hijack a victim's account, balance included.