Post #10684 6.15K Sep 13, 2026, 14:42 UTC $15k - CSPT to full account takeover, then 2FA bypass via the prototype chainhttps://whoareme.com/blog/cspt-account-takeover-2fa-bypass/ Whoareme $15k - CSPT to full account takeover, then 2FA bypass via the prototype chain A client-side path traversal in the front-end's URL builder turned into arbitrary PUT/DELETE on the API, then chained with an inherited-property lookup bug to bypass 2FA ❤ 10 🔥 3