Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
9
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
  • highPGN-10463

    Settlement amount mutated after signature via delimiter-free field concatenation

    The HMAC covered concatenated fields with no separator, so a shifted boundary between amount and session id verified under the original signature.

    Voltgrid@nullwaveImproper Validation of Integrity Check Value22 Oct 2026triage 8.5hresolved 6.1d
    $16,000
    Resolved
  • highPGN-10457

    JMAP blob download ignores mailbox ACL for shared calendars

    Attachments on events in a calendar shared read-only could be fetched by blob id after the share was revoked.

    Nimbus Mail@mirabelMissing Authorization20 Oct 2026triage 6.4hresolved 3.8d
    $11,000
    Resolved
  • highPGN-10451

    Store checkout race duplicates limited cosmetic on concurrent redeem

    Thirty sequential redeem calls succeeded before the first test of concurrency; the inventory check and grant were not atomic.

    Kiln Games@yara.vRace Condition18 Oct 2026triage 36hresolved 11.7d
    $6,500
    Resolved
  • highPGN-10444

    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning

    A CRLF in an H2 header value survived translation at the edge. Impact was framed as capture of the next researcher-owned request on the same connection.

    Parcelo@fennelHTTP Request Smuggling16 Oct 2026triage 46hresolved 13.3d
    $7,000
    Resolved
  • highPGN-10416· undisclosed

    Open-banking consent screen approves scopes beyond those displayed

    Not disclosed. Private program.

    Tessera Bank@saltmarshImproper Authorization08 Oct 2026triage 15hresolved 8.9d
    $20,000
    Resolved
  • highPGN-10387

    Mass assignment on team invite sets owner role via nested attributes

    The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.

    Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d
    $9,500
    Resolved
  • highPGN-10374

    Cache deception on 404 under /account/ leaks CSRF token to shared cache

    The 404 page embedded the per-session token and was cached by path suffix.

    Kiln Games@deadbeef_Web Cache Deception24 Sept 2026triage 35hresolved 11.5d
    $5,000
    Resolved
  • highPGN-10336

    Courier app accepts server-signed delivery proof for a different parcel id

    The signature covered the courier id and timestamp but not the parcel id.

    Parcelo@sableImproper Validation of Integrity Check Value12 Sept 2026triage 43hresolved 15.8d
    $6,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    Stratos ID@nullwaveImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
Hacktivity
Connecting
  • Bounty paidVoltgrid@nullwave
    Settlement amount mutated after signature via delimiter-free field concatenation
    high
    $16k
  • Bounty paidNimbus Mail@mirabel
    JMAP blob download ignores mailbox ACL for shared calendars
    high
    $11k
  • Bounty paidKiln Games@yara.v
    Store checkout race duplicates limited cosmetic on concurrent redeem
    high
    $6,500
  • Bounty paidParcelo@fennel
    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
    high
    $7,000
  • Bounty paidTessera Bank@saltmarsh
    Open-banking consent screen approves scopes beyond those displayed
    high
    $20k
  • Bounty paidLedgerline@hex_tide
    Mass assignment on team invite sets owner role via nested attributes
    high
    $9,500
All disclosed reports →