Viteg Security Review
A security review of Viteg's creator-content platform backend. Found and fixed a cross-user IDOR that let any authenticated user pull another user's personalized content feed by supplying their user ID in a query parameter, an account-enumeration flaw in password reset that let an attacker confirm which emails had accounts, a live database credential hardcoded into source as a fallback connection string, and patched a disclosed Next.js/React CVE (CVE-2025-55182) within days of publication.
Viteg Security Review
A security review of Viteg's creator-content platform backend. Found and fixed a cross-user IDOR that let any authenticated user pull another user's personalized content feed by supplying their user ID in a query parameter, an account-enumeration flaw in password reset that let an attacker confirm which emails had accounts, a live database credential hardcoded into source as a fallback connection string, and patched a disclosed Next.js/React CVE (CVE-2025-55182) within days of publication.
Technologies Used
Results
Cross-user data exposure, account enumeration, and a hardcoded DB credential fixed; CVE patched same week as disclosure