Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/3676308 by glferreira-devsecops
The POST /api/bitcoinWithdrawalFees endpoint returns real-time Bitcoin withdrawal fee data without requiring any authentication, despite being explicitly documented as a "USER OPERATION" (private endpoint) in the official CoinMate API documentation.
This is the only private endpoint that does not enforce authentication. All other USER OPERATION endpoints (e.g., /api/balances, /api/openOrders, /api/bitcoinDepositAddresses) correctly reject unauthenticated requests with {"error": true, "errorMessage": "Invalid request"}.
The authentication middleware/filter on the /api/bitcoinWithdrawalFees endpoint is misconfigured, allowing the request to bypass HMAC-SHA256 signature verification. This is confirmed by the fact that all three official API client libraries (Java, TypeScript, Python) invoke this endpoint via their postPrivate() methods, which attach clientId, nonce, publicKey, and signature parameters.
pyus3rAn unauthenticated AEM Sling servlet exposes four CRUD operations (getData / getDataById / setData / updateData) on the internal marketing-campaign database via a single option request header. The only access control is a Referer string check that any HTTP client trivially bypasses. Anonymous attackers can read the full 79-campaign dataset (including internal segmentation logic and the names of internal prospect databases), create arbitrary new campaigns in the production backoffice, and overwrite existing real production campaigns.
gpk21pyus3rA vulnerability was identified where an authenticated user could disable Multi-Factor Authentication (MFA) on their own account by modifying hidden account attributes through a backend API endpoint. This allowed subsequent logins without an MFA prompt, effectively bypassing the security control and increasing the risk of unauthorized access in the event of credential compromise.
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In