🎯 New Report #3670955: HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API
🔺Severity: Low
👽 Reporter: glferreira-devsecops
⭐️ Reputation: 49
🛠 State: resolved
💼 Team: CoinMate.io
💵 Bounty: null
🕐 Submitted: 2026-04-13
⏰ Disclosed: 2026-05-20 09:26:10
📝 Summary: A vulnerability was discovered in the HMAC signature verification process of the CoinMate API. The signature was calculated using only the nonce, client ID, and public key, omitting the HTTP endpoint and request payload. This allowed an attacker to hijack a valid signature intended for a read-only action and use it to execute a malicious action on a different endpoint, bypassing the cryptographic constraints.
📂 Report JSON File: 3670955
@hackeronereports