LogicalBreach Academy

HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

OtherCVSS 2.5Hard

HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API

hackerone-reports

May 31, 2026

2 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3670955 by glferreira-devsecops

ZERO-DAY VULNERABILITY REPORT

Asset: coinmate.io (Core REST API - https://coinmate.io/api) Vulnerability Type: CWE-325 (Missing Required Cryptographic Step) / CWE-345 (Payload Malleability & Request Forgery) Severity Category: High (CVSS v3.0: 8.1 - AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

Important Triage Note: To prevent false negatives during verification, please carefully read the "Attacker Execution Methodology" section before attempting manual reproduction. Manual re-use of cURL signatures will fail due to the Database's Nonce Replay Protection. We have provided an automated Python PoC to simulate the precise network conditions of the exploit.