LogicalBreach Academy

[Bug Bounty Writeup] Hardcoded Authentication Token in Public JS → Admin API Session Takeover | LogicalBreach Academy

BackHardcoded Authentication Token in Public JS → Admin API Session Takeover

Use of Hard-coded Credentials (CWE-798)CVSS 8.2€564 PRO

Hardcoded Authentication Token in Public JS → Admin API Session Takeover

pyus3r

June 5, 2026

6 min 297

Save

Hardcoded admin token in public JS → unauthenticated admin API session → live tampering of 774 public form labels (legal/payment/support text) on a government portal, plus AES password-encryption key disclosure.

Summary

A hardcoded authentication token was embedded in a public JavaScript bundle served from the admin panel at /forms/[APP]/admin/assets/index-[hash].js.

An unauthenticated attacker could extract this token, exchange it for a valid admin API session through the vLogin endpoint — no credentials, no captcha, no OTP — and then use that session to modify the 774 UI language strings (386 English + 388 Arabic) rendered to every visitor of a public, government-facing certificate-verification form. Modifiable content included form labels, payment text, legal authorization (Letter of Authorization) documents, support contact details and button text.

The changes propagated in real time to the public getLangMaster API and rendered on the form immediately. The same JS file also exposed the AES encryption key (aesEncryptionKey...) used to encrypt all user passwords in the system, along with server file paths, internal hostnames and verbose PHP stack traces.

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Discussion6

huntflag8254d ago

How many bugs have you found so far using n8n's automation? Is there a writeup?

pyus3rRESEARCHER54d ago

I’m not actually using n8n for this

Clop52d ago

Ur mostly hunting bugs where public or private programs??.

pyus3rRESEARCHER52d ago

Mostly private programs

Clop51d ago

I have a question. I know that if a researcher has a good reputation and a lot of points, they can receive private invites. So how do you build a good reputation? Cuz Is it mostly public programs tested very well??

pyus3rRESEARCHER51d ago

In my case, after finding vulnerabilities in public programs, I started getting invited to private ones. That said, completing the YesWeHack CTF can also help.