Moussa Omrane
Software engineer and security researcher. I specialize in full-stack development, web security, and DevOps - and I also design and engineer custom tools to solve specific problems.
Projects
All projects
Security research
- CVE-2026-94612authentikAuthentication bypass in SAML sourceshigh severity, CVSS 7.4
- CVE-2026-94611authentikStored credentials disclosed with view permission alonehigh severity, CVSS 8.1
- GHSA-6xj2-j5p4-rqxcOpenObserveSSRF protection bypass via DNS-resolved private hostshigh severity, CVSS 8.5
- GHSA-4j39-935w-54q2OpenObserveSSRF to the internal network through the /proxy endpointhigh severity, CVSS 8.5
- GHSA-rr62-cx93-4fwhBigBlueButtonSVG injection and SSRF in presentation exportmedium severity, CVSS 5.0
- GHSA-5p2g-ff34-ghm3BigBlueButtonBreakout room access survives participant removalmedium severity, CVSS 5.4
The rest is private: a redacted number of accepted reports across HackerOne, YesWeHack and Bugcrowd.
Writing
All articles- Advent of Code 2024 — Day 2: Red-Nosed ReportsDecember 2024
- Advent of Code 2024 — Day 1: Historian HysteriaDecember 2024
- How To Automatically update git submodules using GitHub ActionsApril 2024
- Advent of Code 2023 — Day 1: TrebuchetMarch 2024
- Backdoor — HackTheBoxNovember 2022
- GDG-2022 — PostalOctober 2022