Bola on nadler // security research

Bola on nadler // security research https://nadleer.github.io/tags/bola/ Recent content in Bola on nadler // security research Hugo en-us Tue, 11 Aug 2026 00:00:00 +0000 From an Email-Change IDOR to Zero-Click Account Takeover https://nadleer.github.io/posts/email-change-idor-zero-click-ato/ Tue, 11 Aug 2026 00:00:00 +0000 https://nadleer.github.io/posts/email-change-idor-zero-click-ato/ How a body-supplied clientId, an attacker-directed OTP, and a login-error identifier leak chained into a zero-click account takeover.