#Improper Input Validation

1 post

BugForge - Daily - Cheesy Does It (Jul 15, 2026)

Cheesy Does It checks username uniqueness on the raw string but NFKC-normalizes the username when authorizing admin actions. Registering a fullwidth homoglyph of admin (ａdmin) creates a distinct account that the app treats as the administrator, leaking the flag from the admin dashboard.

Unicode Normalization Homoglyph Broken Access Control Privilege Escalation Authentication Bypass Improper Input Validation

Posted on 2026-07-15 20:00 6 min read