1. Cross-Tenant Auth Bypass & CSRF Chain via Shared Database

The Setup

While testing a multi-tenant SaaS platform, I noticed something interesting about how they handled custom domains. Enterprise clients were given dedicated workspaces (like victim-workspace.target.com). To keep these environments locked down, the company simply removed the "Sign Up" button from the login page.

That was their first mistake. I suspected they were running a shared database for all tenants in the backend without actually verifying the tenant context during the login flow.

The Logic Flaw

To test this, I went to a public workspace I controlled and registered a standard user account. Then, I navigated over to the victim’s hidden login portal and entered my newly created credentials.

It worked perfectly. The backend checked the shared database, found my credentials, and let me right into the restricted workspace. The UI-level restriction was completely bypassed.

Once inside, I started mapping the API and found the endpoint responsible for revoking API keys. Surprisingly, it lacked any anti-CSRF tokens and relied entirely on session cookies. I had a chain.

Proof of Concept

First, I logged into the restricted workspace using an external account. The backend fails to check if my user origin matches the Tenant-ID.

POST /api/v1/login HTTP/1.1
Host: victim-workspace.target.com
Content-Type: application/json

{
  "email": "attacker@controlled-domain.com",
  "password": "Password123!"
}

With an active session, I crafted an HTML payload targeting the API Key revocation endpoint. If a workspace admin visited my page, their browser silently executed the payload.

POST /api/v1/settings/api-keys/revoke HTTP/1.1
Host: victim-workspace.target.com
Cookie: session_id=xyz987_victim_admin_session
Content-Type: application/x-www-form-urlencoded

action=revoke_all&confirm=true

The Damage

This logic failure let anyone walk right into private enterprise environments. Chained with the CSRF, an attacker could instantly destroy the API keys powering the company's automated workflows, causing immediate operational downtime.

The Resolution

The company confirmed the issue and deployed a fix. They acknowledged the impact and paid the bounty reward.