Luq0x's blog: Offensive Security Researchhttps://luq0x.github.ioen-UShttps://luq0x.github.io/en/writeups/idp-confusion-atohttps://luq0x.github.io/en/writeups/idp-confusion-atoAn email verification flaw in the SSO (OpenID Connect) integration between an educational platform and a publisher's identity provider allowed full takeover of any account, with no password, no token and no interaction from the victim.Mon, 21 Sep 2026 00:00:00 GMTIntigritiBug BountyWebSSOOAuthAccount Takeoverluq0xhttps://luq0x.github.io/en/writeups/chained-idorhttps://luq0x.github.io/en/writeups/chained-idorA chain of IDORs that resulted in a massive PII leak, from names to GPS coordinates of a major e-commerce platform's customersFri, 19 Jun 2026 00:00:00 GMTIntigritiBug BountyWebIDORluq0x