Authentication Bypass on Uber’s Single Sign-On via Subdomain Takeover

arneswinnen.net

11 pointsArtemis22 comments

I find it concerning that the original report apparently "fell through the cracks" and had to be chased up with Uber.

And somehow they did reward it with a $500 bounty before it fell through the cracks, and a $4500 bounty after it was rediscovered.