Whitenbaker
Research Library
Published research, on the record.
Advisories, case studies, concepts and databases. Everything Whitenbaker has published, in one place.
Advisories
Coordinated disclosureCross-tenant session trust in SuperTokens Core
SuperTokens Core honors a session’s embedded tenant claim without checking the request’s tenant, so a token minted for one tenant works in another.
Read advisory →Shipped admin credentials in Juspay Hyperswitch
Hyperswitch ships a working admin key and JWT secret in its default config, and the startup check rejects only blank values, never these defaults.
Read advisory →Redirect-based SSRF in the Infisical webhook handler
Infisical checked webhook URLs against internal ranges, then followed redirects, so a public URL could reach the internal metadata endpoints.
Read advisory →Case studies
Evidence, end to endContagion: multi-tenant auth infrastructure
A cross-tenant session trust flaw in a widely deployed open-source auth framework, and the vendor’s written decision not to fix it.
Read case study →We tried to prove them innocent
Every finding is tested with Analysis of Competing Hypotheses, the framework that survives cross-examination.
Open case files →Incomplete remediation: the window they never checked
Our patch-completeness audit of the fix X shipped after its 2022 data-scraping incident.
Read the audit →Concepts
Definitions and guidesCVE 101: how CVE assignment works
A short, factual guide for vendors receiving a disclosure from Whitenbaker. If your product has never had a CVE, start here.
Read the guide →Deceptive remediation
Silently patching a known vulnerability without a CVE, advisory, or downstream notification. The patch becomes the cover-up.
Read the definition →Fork cascade propagation
How a single upstream vulnerability spreads through the forks that inherit it. An intelligence product from Whitenbaker Labs.
Explore the model →Databases
Records and trackingSilent patch taxonomy
A living catalog of security patches vendors merged without disclosure. Public entries come from MITRE filings; embargoed entries are held until coordinated disclosure.
Open the taxonomy →CVE status tracker
Whitenbaker’s CVE requests with MITRE: CVE-2026-37171 assigned, more submitted and awaiting review.
Open the tracker →The numbers are the proof
Every statistic is backed by reproducible evidence: commit hashes and MITRE filings.
See the record →