Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @nullwave ×
  • highPGN-10463

    Settlement amount mutated after signature via delimiter-free field concatenation

    The HMAC covered concatenated fields with no separator, so a shifted boundary between amount and session id verified under the original signature.

    Voltgrid@nullwaveImproper Validation of Integrity Check Value22 Oct 2026triage 8.5hresolved 6.1d
    $16,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    Stratos ID@nullwaveImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
Hacktivity
Connecting
  • Bounty paidVoltgrid@nullwave
    Settlement amount mutated after signature via delimiter-free field concatenation
    high
    $16k
  • Bounty paidStratos ID@nullwave
    OIDC back-channel logout token accepted without aud check across tenants
    high
    $25k
All disclosed reports →