Freminet: > I didn’t really “access” an account, it was just that the `/createVideo`endpoint wasn’t secured, which let’s you upload videos to any account, it’s not like I was actually logged into the actual account I hear you, and I totally understand. But I have seen good people get fucked by the system, so I feel obligated to point out that this nuance would be lost by most legal systems. Gotta watch out for yourself I very much recommend against testing any vulnerabilities without a legally binding contract exonerating you of any wrongdoing. Despite good intentions, youll still just look like Mr Robot to most

I wanted to put out a warning for anyone currently testing or using the **Neptune App** (the “creator-first” TikTok alternative). I recently did some tests on their API and found a critical **BOLA (Broken Object Level Authorization)** vulnerability that effectively allowed for a platform-wide Account Takeover. **The Exploit:** The `createVideo` endpoint had zero backend validation. By simply swapping the userId in the JSON request, I could generate a signed upload URL for **any account on the platform.** I demonstrated this by successfully uploading videos to the **Founder’s (Moody’s) account** while logged in as a random user. I could have scripted this to flood every verified account with gore, scams, or phishing links. Instead of thanking me for reporting it, they closed my ticket, removed my messages and banned me off their discord server What’s with all these startups and silencing anyone who finds vulnerabilities in their app (reminds me of drime cloud cough cough) I also found more vulnerabilities and I’m glad I didn’t send them, seeing how they treated me! Full breakdown: GitHub - Freminet/neptune-IDOR-BOLA-exploit: Neptune App IDOR/BOLA exploit