Show me where you can "open a tunnel" using the XSS in this post.
> Anything the user can do, you can do via an XSS attack.
I just explained why this isn't a reasonable assumption. You seem to have multiple fundamental misunderstandings about web application security so I don't think it's constructive for either of us to continue this conversation.
Except discord.com doesn't execute JavaScript, the user's browser does. These are meaningful distinctions that delineate the impact. You aren't "discord.com" if you target someone with an XSS exploit, you've only run a script in a user's session. Whether you can actually do anything with that script or not decides whether you can take over the account or not.
It's a good question and one mature orgs ask themselves all the time. As you can see from most of the replies here, XSS captures the fancy of the bug bounty crowd because there are tonnes of hypothetical impacts so everyone is free to let their imagination run wild when arguing with triagers. It's also the exploit nonpareil for nerdsnipers because sanitisation is always changing and people get to spend their days coming up with increasingly ridiculous payloads to bypass them. In reality, find me one active threat actor who has compromised a business lately with an XSS. It's not an irrelevant risk, but the attention it gets is wildly disproportionate to its real-world impact.
As someone in a related line of work: we find vulnerabilities so close to 100% of the time that it might as well be 100% of the time. Whether they're practically exploitable or surpass your risk appetite is the real question.
XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party using Mintlify is vulnerable to account takeover is highly dubious based on what's presented.
And to my earlier point, none of that is in the writeup here to support the enormous claims made in framing the finding. This is good work, and congratulations on the bounty. I hope you have a long career in security ahead. Obviously you communicated your findings to Discord clearly enough for them to understand the impact. I look forward to reading more research from you all in the future and I hope the technical details will accompany it.
Nice! So the Cookie is accessible by JavaScript on all of those sites? That would be pretty surprising given the prevalence of HttpOnly, so that doesn't seem clear to me at all. And they're all using Cookie-based auth, you think? You're a bug bounty hunter so I'll defer to your wisdom, but doesn't it seem more likely that an account takeover would be possible via a state-changing request from the user's existing session? Let's say they can abuse it to reset the user's password. Nice, that's an account takeover... for every user not using MFA. But then there are anti-CSRF mitigations. Okay, not insurmountable with an XSS, but implemented differently everywhere. And what if the auth domains are separate to the domain on which the XSS is triggered? Man this seems to get less clear by the minute. Please clear this up for me.
You're pretty much on the money. Reflected XSS requires social engineering to really target anyone without other primitives. Unfortunately this report is not very clear about the tangible impacts or limitations of what they could do with this particular XSS either. Saying that every Mintlify customer was "vulnerable to account takeover with a single malicious link" strikes me as specious to say the least. Still, can't fault kids for getting excited about recognition and a payout.
I don’t think we should pass laws just because there was allegedly a nice thought behind him. More reasonable protections have been in discussion for long before this entered the picture. That aside, you probably missed this, but the exact same government passed a law to convict children with adult sentences in the same week as this. You probably also missed that this same government which pledged to pass ready-to-go privacy laws at the start of its previous term has taken that off the table. There were plenty of other options that were already being deliberated to deal with your concerns, but this government is the one that has “dismissed” them, not critics of this reactionary theatre.
This comment is a neat encapsulation of the hypocrisy in the “think of the children” mentality. We’ve gotta protect the kids, let’s push them around like obstacles and exclude them from society!
Meanwhile, social media is melting the brains of everyone over 45 into relitigating moon landing conspiracies. Maybe a bit less time in YouTube holes and a bit more time actually parenting would be good for both parties.
Obviously software development in general has become more ingenious (by some metrics) over the past few decades but very little of its growth has involved secure development principles. Often the primary goal is efficiency and scalability with as little friction for the customer. The priority is enabling commerce, not protecting user data (slightly more so company data, but not by much). I speak to devs every week who are unfamiliar with things like JavaScript injection and SSRF, things that can be exploited by virtually complete beginners. From their perspective they were just building a neat feature, that it could be used to render external scripts or internal file paths literally did not occur to them. This isn’t a judgement of them, I appreciate the chance to help them, but just to say development has unfortunately always had other priorities.
Stock price is an extremely narrow view of the total consequences of lax cybersecurity but that aside, the notion that security doesn’t matter because those companies got hacked is ridiculous. The reason there isn’t an Equifax every minute is because an enormous amount of effort and talent goes into ensuring that’s the case. If your attitude is we should vibe code our way past the need for security, you aren’t responsible enough to hold a single user’s data.
> It has been implemented so that age verification is a token only, a yes/no authorisation.
This is misinformation. The legislation does not specify a single particular implementation for age-based verification and there's absolutely no single "age verification service" that platforms are legislated to use. Instead they're required to verify users' ages based on several recommended methods, including age inference. https://digitalrightswatch.org.au/2025/12/03/what-you-need-t...
Further, the Communications Minister herself regarding whether she's concerned about people bypassing authentication-based age verification checks: "If you’re an adult - you probably won’t need to do anything extra to prove your age, because like I said before, these platforms have plenty of data to infer your age." https://minister.infrastructure.gov.au/wells/speech/address-...
The government have previously stated they won’t pursue breaches unless they’re particularly egregious anyway so this is basically shameless political theatre.
Given that “social media” is in fact not banned and all this does is impact a select (and frankly logically inconsistent) list of services, this seems very unlikely. Children are still free to be groomed and gamble on Roblox and join servers belonging to The Com on Discord. To be clear I don’t think those services should be regulated by this obscene law either but this isn’t going to bring back any kind of halcyon era for kids. It will expand the surveillance of and shame around young people’s internet use, however.
eSafety’s line against this sort of bypass is they’re mandating that bans are arbitrated based on user activity and behaviour. So the reality is that the government is attempting to force companies to increase their surveillance of children (and every other user in the process).
Most people shouldn't use a Pi because most people can't configure a web server securely. A VPS would be a better option for just about everybody trying to "self-host" whether they put Cloudflare in front of it or not.
If you're working with the people Amazon works with, the risk assessment isn't "Will we get in trouble for this?" it's "When we get in trouble for this, can we defend it on legal grounds?" Given that even the American spooks cited in this article are defending this blatantly immoral and obscene trespass, obviously Amazon's lawyers have reason to believe they can.
You are dreadfully insistent on proof yet provide none of your own that there is no genocide, despite multiple credible organisations and experts, and the consensus of the international community, contradicting you.
The problem (exhibited all over this thread) is the conflation of protocols and apps. You misled yourself by overthinking it. This happened a lot a couple of years ago when people fled Twitter for Mastodon, putting themselves off by assuming they needed to understand nuts and bolts irrelevant to their use case. Did you need to know how HTTP works to use a web browser? Of course not. Likewise, most people confused about Mastodon would be better served if they understood they just had to sign up on a website and start talking to people, same as anything else. In this case, if all you wanted was to try a chat app, you should’ve started at Element and you never needed to even know about Matrix. People using these things interchangeably has done enormous harm to the decentralisation movement.