nday.lol/ security research

Research notes / responsible disclosure

Blog

Technical accounts of security issues I found, reported, and waited to see fixed before publishing.

Redacted view of an affected NASA internal page with organizational identifiers and employee information obscured.

Path-Based Access Control Misconfiguration Exposed Internal NASA Resources

A public route exposed limited employee directory details, profile links, and internal presentation templates without authentication.

Status
Resolved
Severity
P4 / Low
2 min read
Broken Access Control
Discord test server showing the guest session outside the visible voice-member list while a channel message remains visible.

Race Condition in Discord Guest Invites Led to Broken Access Control and Secret Message Access

A guest session could remain in a server outside the intended voice-channel lifecycle, without appearing in the member list.

Status
Resolved
Severity
P2 / High
2 min read
Broken Access Control
Discord client displaying a Messages Failed to Load banner during the rate-limit test.

Improper Input Validation in Discord Template Links Caused Request Loops and Account Rate Limits

Malformed template identifiers triggered repeated background requests, client lag, and account-wide rate limiting.

Status
Resolved
Severity
P2 / High
2 min read
Improper Input Validation