SellAuth (sellauth.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

SellAuth concentrates session cookies, OAuth/SAML bridging, API bearer rotation, reseller or team hierarchies, license seat enforcement, SSO callback URLs, MFA enrollment state, webhook HMAC issuance, admin impersonation tooling, edge caching of authenticated HTML — fertile ground for account takeover, cross-tenant privilege bleed, and forged entitlement issuance if isolation breaks. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP host answering for sellauth.com and delegated subdomains, websocket or SSE channels they operate, Postgres rows under their infra, CDN bundle origins they sign or host, SAML/OIDC metadata endpoints, mobile or desktop deep-link handlers advertised in their docs, preview/staging clones they label, Grafana/Sentry ingestion they administer, worker runtimes emitting auth webhooks.
Civil exclusions only: credential stuffing unrelated third-party sites outside SellAuth login context, ransomware of hospitals, phishing campaigns against random consumers unrelated to bounty testing. Societal bans — not SKU-level fences.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows must exhibit (a) attacker-readable kill-chain storytelling and (b) objective proofs of successful exploitation replayable by SellAuth responders (Burp transcripts, scripted API sequences, OAuth callback replays, JWT mutation evidence, stolen session fixation logs…).

These rows do not impose limits — shorthand for tagging reports. Anything SellAuth hosts, signs, proxies, caches, parses, verifies, webhook-delivers counts as bounty ground even if undocumented here. Treat “not listed” ≠ “out-of-scope”: default stance is open scope across SellAuth.

This playbook refuses “only these SKU endpoints.” Sandbox shards, mirrored tenants, Grafana boards, ephemeral feature flags, SMTP bridges that deliver magic links SellAuth signs, Zapier-esque automation patched by SellAuth — all bounty eligible when critical impact is reproducible.

• Every apex / vanity hostname routing through SellAuth edge — claim routing evidence inside your chain write-up.
• Infrastructure-as-code or SDK repos SellAuth merges affecting auth boundary
• WASM/edge workers they inject into dashboard or login bundles
• Partner OAuth apps gated through SellAuth consent UX

1. Prove exploitation success. Ship artefacts third parties rerun: scripted curl/openid-client flows, deterministic Burp exports, SSO callback trace captures, JWT tamper scripts, SSRF egress PCAPs showing metadata hits.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (ATO chains, counterfeit licenses, infra pivot, mass org-wide token theft…).
3. Responsible blast radius documentation. Quantify accounts or reseller trees exposed even when exercised only on staging mirrors that faithfully route like production.
4. Encrypt & ship privately. Use sanctioned intake (security channels on sellauth.com — see submit section) before public disclosure.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on collisions.

Start from the security / disclosure contact publicly listed on sellauth.com (often security@sellauth.com or similar — verify on the vendor site before sending). Mandatory sections mirror below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to SellAuth critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session assumptions, OAuth app ID, reseller org ID)
2. Entry primitive — exact HTTP verb/path/query/body or callback parameter line
3. Pivot(s) chaining trust escalation
4. Final hop → ATO chain / forged entitlement / infra takeover equivalent

## Successful exploitation evidence
• Replayable CLI script showing JWT/session escalation or SSO failure
• HAR / Burp with matched responses proving unauthorized boundary cross
• Webhook/logs illustrating attacker-controlled issuance or revocation

## Reproduction package
Commands + fixtures + pinned SHAs

## Disclosure ack
Responsible channel only until SellAuth clears publication coordination

Pseudocode illustrating a bypass of OAuth state correlation — useless without attaching HAR evidence that a victim session is swapped on sellauth.com callbacks.

// BUGGY: echoes state cookie without CSRF/token bind
import express from 'express';
const app = express();
const sessions = Object.create(null);

app.get('/oauth/callback', (req, res) => {
  const sess = sessions[req.query.state]; // FIXED: attacker replays leaked state ⇒ wrong user bound
  sessions[req.query.state] = undefined;
  res.cookie('sa_session', issueToken(sess.userId)); // attacker becomes victim
  res.redirect('/dashboard');
});