🎯 New Report #3475626: Session Cookie Leakage via Static Header Field in WebViewerFragment
🔺Severity: High
👽 Reporter: dphoeniixx
⭐️ Reputation: 2424
🛠 State: resolved
💼 Team: LinkedIn
💵 Bounty: null
🕐 Submitted: 2025-12-22
⏰ Disclosed: 2026-03-17 06:13:57
📝 Summary: A vulnerability was identified in the "WebViewerFragment" that could lead to the leakage of the user's cookies. The root cause was a static field ("CUSTOM HEADERS") that persisted cookies across different URL loads, allowing an attacker to steal the victim's session cookies. The vulnerability was demonstrated through a complex exploitation chain involving chaining multiple weaknesses.
📂 Report JSON File: 3475626
@hackeronereports