Always check for leaked JWTs for internal APIs. This can result in unauthorised access to APIs that return mass PII. In this case, the API leaked PII of 2637711 users.

Bounty: $1000

@yeswehack

credit: @ShawarkOFFICIAL 

#bugbountytips #infosec #Bugbounty
#bugbountytips #infosec #Bugbounty