🎯 New Report #3966599: Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect
🔺Severity: Medium
👽 Reporter: notnotnotveg
⭐️ Reputation: 718
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-08-24
⏰ Disclosed: 2026-10-16 21:35:28
📝 Summary: Multiple security vulnerabilities were identified in an unauthenticated go-httpbin server instance. An endpoint was found to accept arbitrary cookie domain parameters, allowing attacker-controlled cookies to be set across subdomains of a parent domain. This caused cookies to be delivered to unrelated sibling applications. A crafted cookie value was observed to trigger a denial of service response when received by another application on the same domain. Additionally, an open redirect endpoint was discovered that accepted arbitrary URLs and redirected users without validation. The cookie injection issue was verified to have practical cross-tenant impact through denial of service conditions.
📂 Report JSON File: 3966599
@hackeronereports