Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
2
Paid in this view
$665k
Filtered by @saltmarsh ×
- criticalPGN-10482
SAML assertion accepted after signature element is relocated under a wrapped Response
A second Assertion placed before the signed one was processed by the relying-party parser while the signature check ran against the original. Proof used two researcher tenants.
Stratos ID@saltmarshImproper Verification of Cryptographic Signature29 Oct 2026triage 3.5hresolved 4.3d$96,000Resolved - highPGN-10416· undisclosed
Open-banking consent screen approves scopes beyond those displayed
Not disclosed. Private program.
$20,000Resolved
Hacktivity
Connecting- SAML assertion accepted after signature element is relocated under a wrapped Responsecritical$96k
- Open-banking consent screen approves scopes beyond those displayedhigh$20k