Hacker News Reader

This one from a year ago?

"This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments)."

oh ffs, I forgot about this. I was thinking of the other one though from 2021 mentioned in a sibling comment, and it was indeed, again, with cosmos

There have been a lot. I remember one that was essentially “send the request without an Authorization header.”