Vulnerability research, bug bounty writeups, and notes from a pentester building toward OSCP.https://builtbybrayden.github.io/https://builtbybrayden.github.io/blog/privategpt-062-unauthenticated-by-default/https://builtbybrayden.github.io/blog/privategpt-062-unauthenticated-by-default/PrivateGPT 0.6.2 ships with API authentication turned off on a server listening on every interface, plus unbounded upload and query parameters that make denial of service a one-line curl. Reported in April 2026, with no response from the vendor.Fri, 30 Oct 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-asset-update-checkout-bypass/https://builtbybrayden.github.io/blog/snipeit-asset-update-checkout-bypass/A missing authorization check in Snipe-IT let a user with only asset-edit rights push assignment fields through the update endpoint and check out equipment they were explicitly denied checkout access to. Rated Medium severity, CVSS 6.5.Sat, 19 Sep 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-encrypted-field-plaintext-write/https://builtbybrayden.github.io/blog/snipeit-encrypted-field-plaintext-write/A missing branch in one Snipe-IT API endpoint wrote values into encrypted-flagged custom fields as raw plaintext when the caller lacked the right permission, breaking encryption-at-rest for that column. Rated Low.Sat, 07 Nov 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-google-sso-deactivated-user/https://builtbybrayden.github.io/blog/snipeit-google-sso-deactivated-user/Snipe-IT enforced the deactivated-account check on every login path except Google sign-in, so a disabled user whose Google identity was still live could log back in at their old permission level. Rated Moderate.Sat, 07 Nov 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-ldap-starttls-downgrade/https://builtbybrayden.github.io/blog/snipeit-ldap-starttls-downgrade/Snipe-IT ignored whether its LDAP connection actually upgraded to TLS, so a failed or stripped handshake let it send directory and user passwords in cleartext while login looked normal. Rated Moderate.Sat, 07 Nov 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-maintenance-cross-tenant/https://builtbybrayden.github.io/blog/snipeit-maintenance-cross-tenant/A missing permission check in Snipe-IT let one company silently attach maintenance records to another company's equipment. Rated High severity, CVSS 7.7.Sat, 25 Jul 2026 00:00:00 GMThttps://builtbybrayden.github.io/blog/snipeit-saml-assertion-replay/https://builtbybrayden.github.io/blog/snipeit-saml-assertion-replay/A race condition in Snipe-IT's SAML single sign-on let a captured login be replayed into multiple sessions, so revoking one did not revoke the others. Rated Moderate.Sat, 07 Nov 2026 00:00:00 GMT