Title
Railway-hosted auth bypass via session fixation on kurs.onecode.de
Target
kurs.onecode.de
Class
AUTH
Confidence
65/100
Reasoning
Host runs on Railway (tgk4io5m.up.railway.app), serves 307 redirect to /login with railway-hikari server header. Railway apps commonly use cookie-based sessions; if session ID not regenerated post-login, fixation possible. No rate-limit headers observed in passive scan.
Evidence needed
Set-Cookie header on /login response pre-auth; session ID reuse after successful login; absence of Secure/HttpOnly/SameSite on session cookie
Verify steps
GET https://kurs.onecode.de/login (capture Set-Cookie); POST /login with valid creds (test account) observe if session ID changes; check cookie attributes
Impact
ATO on customer portal → course access, PII, payment data — HIGH
Testability
AUTH_HELPED
model: nemotron3 · auto-synced from leads/lead-*.md
Title
Railway-hosted auth bypass via session fixation on kurs.onecode.de
Target
kurs.onecode.deClass
AUTH
Confidence
65/100
Reasoning
Host runs on Railway (tgk4io5m.up.railway.app), serves 307 redirect to /login with railway-hikari server header. Railway apps commonly use cookie-based sessions; if session ID not regenerated post-login, fixation possible. No rate-limit headers observed in passive scan.
Evidence needed
Set-Cookie header on /login response pre-auth; session ID reuse after successful login; absence of Secure/HttpOnly/SameSite on session cookie
Verify steps
GET https://kurs.onecode.de/login (capture Set-Cookie); POST /login with valid creds (test account) observe if session ID changes; check cookie attributes
Impact
ATO on customer portal → course access, PII, payment data — HIGH
Testability
AUTH_HELPED
model: nemotron3 · auto-synced from leads/lead-*.md