LogicalBreach Academy

Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

OtherCVSS 2.5Medium

Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption

hackerone-reports

May 31, 2026

1 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3625600 by bereza4321

Improper Input Validation Order (CWE-20) in Authentication Endpoint

Type: Architectural Security Issue
CWE: CWE-20 – Improper Input Validation
Severity: High

Summary

The /api-internal/login authentication endpoint in Burp Suite DAST (Enterprise) internal login interface (test instance) processes user-supplied input before enforcing field-level validation, allowing extremely large payloads in the password field to be buffered and parsed prior to rejection. Domain intentionally omitted for confidentiality.