← All credits

Enno Gelhaus

5 vulnerability records and advisories credit this contributor.

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

CVE-2026-107761

Channel tokens and organization API key exposed in API responses

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key