critical Unauthenticated webhook write access

Public JavaScript Bundle Leaks Production Provider Key, Enabling Unauthenticated Webhook CRUD

A Web3 quests platform shipped a production blockchain data provider API key in its public Next.js bundle, allowing any unauthenticated visitor to create and delete webhooks on the company's billed third-party account.

Feb 21, 2026
WebHardcoded SecretsAccess Control
critical Wallet master keys leaked

Public Telemetry Endpoint Leaks Bitcoin Wallet Master Keys

A self-custody wallet provider's production telemetry exposed thousands of Bitcoin extended public keys to the open internet, enabling permanent wallet surveillance.

Feb 21, 2026
WebData ExposureWallet
critical Cloud credential theft path

Unauthenticated SSRF Enables Cloud Metadata Exfiltration and Internal Network Access

Unauthenticated webhook endpoint allowed full-read SSRF. Cloud IMDS accessed via redirect bypass, 14 internal hosts mapped.

Feb 21, 2026
WebSSRFCloud
critical 45K wallets exposed

Misconfigured Supabase RLS Exposes 45,000 Wallet Addresses and Enables Mass Data Deletion

Anonymous role had read/update/delete on 13 tables. 45,372 wallet addresses with trading volumes exposed.

Feb 21, 2026
WebAccess ControlData Exposure
critical $30M reserves exposed

Public Executive Dashboard Exposes Reserves, Business Metrics, and User Data

A P2P trading platform's internal executive dashboard endpoint required no authentication, exposing approximately $30M in crypto reserves, live business metrics, and user personal data.

Feb 21, 2026
WebAccess ControlPII Exposure
critical Full DB downloaded

Exposed Vite Dev Server in Production Enables Full Database Exfiltration

Dev server in production exposed 6.1MB database with admin credentials, API tokens, and GitHub PAT.

Feb 21, 2026
WebMisconfigurationData Exposure
high Forged green checks on contract code

CI Supply Chain: Unverified Installer Pipe and Mutable Action Tag Enable Test Result Forgery

A Layer 1 blockchain naming service used a curl-pipe-to-python installer and a tag-pinned checkout action in its smart contract test workflow, enabling CI runner code execution and forged test results on contract changes.

Feb 21, 2026
Supply ChainSmart ContractMisconfiguration
high Internal admin endpoints public

Feature Toggle Service Exposes Internal Admin Endpoints to the Public Internet

A DeFi aggregator's portal exposed its feature toggle service's internal admin endpoints with no authentication, leaking 116 flags, the production token inventory, privileged staff IDs, and the compliance country list, with leaked IDs usable to unlock hidden features and flip payment routing.

Feb 21, 2026
WebMisconfigurationData Exposure
high Compliance bypass via spoofed header

Forwarded Header Trust Bypasses Country and Restricted-Asset Compliance Checks

A cryptocurrency exchange decided sanctioned-country and country-specific asset restrictions based on a client-supplied forwarding header, allowing any unauthenticated visitor to flip the compliance decision with one line.

Feb 21, 2026
WebBusiness LogicAuthentication
high Live exchange creds in public code

Production API Credentials Hardcoded in Public Sample Code

A crypto exchange shipped working production API credentials inside a public sample script, granting private account read access and trading write actions.

Feb 21, 2026
WebHardcoded SecretsAuthentication