Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
3
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:stratos-id ×
  • criticalPGN-10482

    SAML assertion accepted after signature element is relocated under a wrapped Response

    A second Assertion placed before the signed one was processed by the relying-party parser while the signature check ran against the original. Proof used two researcher tenants.

    Stratos ID@saltmarshImproper Verification of Cryptographic Signature29 Oct 2026triage 3.5hresolved 4.3d
    $96,000
    Resolved
  • criticalPGN-10428

    Passkey ceremony accepts attestation for a different relying-party id under a wildcard origin

    rpIdHash was compared against a wildcard-expanded set that included a sibling subdomain the researcher controlled.

    Stratos ID@ilseImproper Authentication11 Oct 2026triage 3.3hresolved 4.5d
    $70,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    Stratos ID@nullwaveImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
Hacktivity
Connecting
  • Bounty paidStratos ID@saltmarsh
    SAML assertion accepted after signature element is relocated under a wrapped Response
    critical
    $96k
  • Bounty paidStratos ID@ilse
    Passkey ceremony accepts attestation for a different relying-party id under a wildcard origin
    critical
    $70k
  • Bounty paidStratos ID@nullwave
    OIDC back-channel logout token accepted without aud check across tenants
    high
    $25k
All disclosed reports →