Peregrine
Start hunting
← Leaderboard
#1 · 90 days#1 · all timeTop 10 · 2025Mediator

@nullwave

🇩🇪member since 01 May 2022·Authentication · SSRF · Business logic
All disclosed reports
Reputation
18,420
Signal
7.4
avg severity of valid reports
Impact
31.2
bounty-weighted
Earned, 90d
$86k
Earned, all time
$612k
Valid reports
214
31-week streak
Disclosed reports · 2
$41k shown
  • highPGN-10463

    Settlement amount mutated after signature via delimiter-free field concatenation

    The HMAC covered concatenated fields with no separator, so a shifted boundary between amount and session id verified under the original signature.

    VoltgridImproper Validation of Integrity Check Value22 Oct 2026triage 8.5hresolved 6.1d
    $16,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    Stratos IDImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
Programs
Portable record

Every outcome on this profile is signed by the program that decided it. Export the record and verify it anywhere.

pgn record export @nullwave --sign