hunt-business-logic
Crown Jewel Targets
Business-logic flaws are the highest-creativity-required class in bug bounty — most don't get CVEs because they're application-specific, but they're often the highest-paying single-finding class on commercial SaaS because they map directly to financial loss. The 24-month meta has crystallized around eight asset types. All CVEs below are NVD-verified.
1. Payment / checkout flow manipulation (mid four-figure to mid five-figure on e-commerce / fintech). The "client trusts price/quantity" pattern. CVE-2024-50654 Lilishop coupon overpurchasing (CVSS 7.5 HIGH) — concurrent coupon-collection requests bypass quantity limit. AlegroCart v1.2.9 negative-quantity price manipulation (Andrey Stoykov disclosure SecLists Apr 2025 at https://seclists.org/fulldisclosure/2025/Apr/22) — GET /alegrocart/index.php?...&quantity=-100 produces -100 × $15.99 = -$1,599.00 cart subtotal; checkout flow accepts negative total. Bagisto CMS v2.3.6 cart price manipulation (Rudransh Singh Rajpurohit Sep 2025 at https://medium.com/@rudranshsinghrajpurohit/cve-2025-56426-cart-price-manipulation-vulnerability-in-bagisto-cms-468b72311969) — modify cart parameter to -1, system subtracts instead of adds, can place order with $0 total. The Bug Bounty Playbook documents this comprehensively at https://bugbounty.info/Attack-Surface/Web/Business-Logic/Price-Manipulation: change 99.99 to -99.99 and watch the app issue you a refund on checkout.
2. Race-condition payment / wallet / coupon (mid five-figure on programs that triage these as critical). The TOCTOU pattern between balance check and balance update. CVE-2026-34368 WWBN AVideo YPTWallet TOCTOU (GHSA-h54m-c522-h6qr) — transferBalance() reads sender's wallet balance, checks sufficiency in PHP, writes new balance — all without database transactions or row-level locking. Concurrent transfers all read same stale balance, each passes check, only one deduction applied while recipient credited multiple times. With $10 balance and N concurrent requests, recipient receives up to $10×N. Aditya Bhatt May 2025 InfoSec writeup (https://medium.com/bugbountywriteup/bug-bounty-race-exploiting-race-conditions-for-infinite-discounts-a2cb2f233804) — applied discount coupon 20× simultaneously via Burp Suite Repeater Parallel Execution, server processed all → cart price reduced to near-zero. Industry precedents: Tesla Bug Bounty 2020 (free vehicle software upgrades via concurrent purchase requests), Uber 2016 (infinite promo credits via race), OpenCart checkout TOCTOU disclosed Dec 2025 by KhanMarshaI (https://gist.github.com/KhanMarshaI/a55f125a55de1c0d4f41e66236027e01) — guest-attacker concurrent checkout creates 3 orders for 1 stock item, inventory drops to -2.
3. 2FA / MFA bypass via auxiliary flow (low five-figure on programs that pay this class). Multi-factor auth bypassed because the "skip" path or alternate-flow doesn't enforce the second factor. CVE-2025-3910 Keycloak 2FA bypass (GHSA-5jfq-x6xp-7rw2, CVSS 5.4) — org.keycloak.authorization package allows users to circumvent required actions including 2FA setup. Affects Keycloak 26.0 through 26.0.10. 2FA Bypass via Reset Password (KhaledAhmed107 Jan 2026 at https://systemweakness.com/2fa-bypass-via-reset-password-daba828b10f3, Bugcrowd VRT P3) — enable 2FA with Google Authenticator → log out → password reset flow shows "Skip" option for 2FA verification → bypassed. Samsung Account 2FA bypass (Gregory Greekas 2024 at https://www.hackingadventures.ca/posts/samsung-2fa-bypass) — 2FA request API discloses victim's IMEI to anyone with username; deviceUniqueId derived deterministically from IMEI; attacker computes expected deviceUniqueId, includes in auth request, bypasses 2FA on Samsung Account globally. Samsung patched Dec 2024. Pre-Account Takeover via SSO migration (Giongnef Jan 2024 at https://giongfnef.medium.com/business-logic-bypass-2fa-to-ato-e0dc7131b10e) — pre-register victim@companyA.com in Store DB, use Migrate function to transfer to SSO DB, wait for victim to register; attacker still has access to all resources after victim signs up.
4. Free-trial / subscription abuse (mid four-figure on SaaS programs that pay this class — many don't). Doppler free-trial reset (Aditya Sunny Dec 2024 at https://adityasunny06.medium.com/how-i-identified-a-revenue-loss-bug-in-dopplers-free-trial-system-b88919aa161f) — disclosed Nov 14 2024 to Doppler — sign up → activate 14-day trial → cancel → switch to free Developer Mode → revert to paid Team Mode → premium features regranted indefinitely. Email-alias unlimited trial abuse (Mahmoud Magdy Dec 2025 at https://medium.com/@mahmoudmagdy45456/violation-of-secure-design-principles-unlimited-free-trial-abuse-via-email-aliases-3de0756eb58c) — register user+a1@gmail.com, user+a2@gmail.com, etc.; all deliver to same inbox but app treats each as new user. Stripe hasEverTrialed bypass (better-auth issue #6863 Dec 2025 at https://github.com/better-auth/better-auth/issues/6863) — findOne returns whichever subscription DB returns first; if it's a new incomplete subscription, hasEverTrialed returns false — user trials again on Stripe. HackerOne 2024 H1 high "Premium Trial Subscription Upgrade and Claim Offer" — total price reduced via promo logic.
5. Coupon stacking / discount abuse (low to mid four-figure on most e-commerce; mid four-figure on race-chained variants). Apply same coupon multiple times, apply multiple distinct coupons when only one allowed, change discount-application order. Aditya Bhatt May 2025 (above) — coupon applied 20× via parallel race; cart value = jacket price - (discount × 20). Unlimited Reuse of Coupon Code Allows Free Shipping (H1 2026 low) — coupon validation lacks usage tracking. Bug Bounty Playbook: stack aggressively until you hit the cap; check if cap logic is bypassable.
6. OTP / phone-number manipulation flows (mid four-figure to low five-figure on programs that triage as ATO). Change Phone Number OTP Flaw → Any Phone Number Takeover (H1 2024 critical disclosed) — change-phone flow doesn't verify ownership of the new number, just sends OTP to it; attacker can change victim's phone via crafted request. The pattern: phone-change API accepts new phone number from request body, sends OTP only to the new (attacker-controlled) number, attacker confirms with their own OTP, victim loses account access.
7. Role / scope / tier escalation via business-logic bypass (mid four-figure on multi-tier SaaS). OpenClaw WebSocket shared-auth elevated scopes (GHSA, 2026 critical) — WebSocket connections share auth context across users; client can self-declare elevated scopes. Business Logic Bypass: Setting "Read Access" Role Without Pro Plan Subscription (H1 2026 medium) — role-assignment API doesn't check subscription tier. Authorization Bypass in Starknet Snap via enableAuthorize parameter (H1 2026 medium) — toggle parameter bypasses authorization check. CVE-2026-30956 OneUptime, CVE-2026-32131 Zitadel, and CVE-2025-64431 Zitadel V2Beta are the 2025-2026 tenant/scope-control analogs: client-controlled tenant context or insufficient org scoping turns a normal user into cross-tenant admin. CVE-2024-21632 nOAuth and CVE-2025-55241 Entra actor-token impersonation are identity-logic variants: the app trusts the wrong claim, wrong tenant, or wrong actor.
8. Workflow-step skipping (mid three-figure to low four-figure direct, mid four-figure when chained). Multi-step flows where step N can be skipped via direct API call. Business Logic error leads to bypass 2FA requirement (H1 2024 high) — direct API call to step N+1 bypasses step N. Create account without auth via response manipulation (H1 2026 low) — modify the success response in transit, app redirects to authenticated state. Customer can cancel individual booking in a batch causing partner lock (H1 2025 medium) — atomicity violation.