Fix-Bypass on MOZAhttps://moza369.github.io/tags/fix-bypass/Recent content in Fix-Bypass on MOZAHugoen-usMon, 12 Jan 2026 00:00:00 +0000AWS Firehose Credentials Fix Bypasshttps://moza369.github.io/writeups/aws-credentials-fix-bypass/Mon, 12 Jan 2026 00:00:00 +0000https://moza369.github.io/writeups/aws-credentials-fix-bypass/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>REACTED</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Information Disclosure — Fix Bypass</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Medium</td> </tr> <tr> <td><strong>Status</strong></td> <td>Triaged</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>I was reading through disclosed HackerOne reports when I came across a publicly disclosed vulnerability about exposed AWS Firehose credentials on a DoD system. The report had been marked <strong>&ldquo;Resolved&rdquo;</strong> back in February 2025.</p> <p>But resolved doesn&rsquo;t always mean fixed properly.</p> <p>I grabbed the credentials from the original disclosure and tested them. They still worked.</p>