writeups.xyz / Unprotected API endpoint at HAwebsso.nl leads to data leak of +15k medical doctor usernames & password hashes

Submitter : c2a

Date: 14 December 2022

Bounty : undisclosed

Vulnerabilities :

• SSO
• IDOR
• Missing Authentication

Programs :

• HAwebsso.nl

Authors :

• Jonathan Bouman (@JonathanBouman)

Link :
https://medium.com/@jonathanbouman/unprotected-api-endpoint-at-hawebsso-nl-5f1951e212fe