Overwriting Booktics Customer Details Without Logging In
CVE-2026-11446: a public booking request could overwrite an existing Booktics customer's contact details using only their email address.
whoami
I do security stuff.
Sometimes I fix things, sometimes I break things, occasionally find time to write about it. Disclosures, research notes, and the odd blog post live here.
recent
RSS feed ↗UK-based online travel company GitHub misconfiguration
Severity: critical · Platform: private · Bounty: $3,500 Disclosure of an OIDC misconfiguration in a public GitHub repository leading to access to confidential private data. Specifics kept
I Scanned 4,500 GitHub Repositories for Misconfigured GCP Workload Identity, Here's What I Found
Previous Findings A few years ago I wrote about how misconfigured GCP Workload Identity Federation providers could allow any GitHub Actions workflow to authenticate as someone
Stealing AWS Credentials With a Single Pull Request
Severity: high · Platform: other While doing research for a follow-up to my GCP Workload Identity post, I kept noticing pull_request_target misuses alongside the
Berkeley Lab GitHub Misconfiguration
Severity: critical · Platform: other Disclosure of an OIDC misconfiguration in a public GitHub repository. Specifics kept private at the request of the programme team. 2026-04-
Exploiting misconfigured Google Cloud Service Accounts from GitHub Actions
Most repositories have switched to OIDC for their GitHub Actions that are connected to GCP. This might seem like a win because Service Account Keys are