Available NowIntermediate

Hotel SaaS Authentication Lab

A realistic hotel property management system with OAuth-style authentication, SSO partner integrations, and redirect handling vulnerabilities. Based on a real bug bounty finding.

Login page with ReturnUrl redirect parameter

Post-authentication dashboard showing property list

Open redirect exploit — token leaked in URL to external domain

SSO partner authorization flow with redirect_uri parameter

Scenario

Pinnacle Hotels runs a property management system used by hotels, staff, and booking partners. The authentication system has evolved over several years — different teams wrote different auth middleware, creating inconsistencies in how redirect URLs are validated.

The platform recently added SSO for hotel partners, mobile deep linking, and guest invitation flows. These features introduced flexible redirect handling, with legacy compatibility code that still runs in production.

Auth Flows

Standard Login

Email/password with ReturnUrl parameter. Validated by legacy regex-based middleware.

SSO Partner Login

OAuth-style flow with GrandPeak Hotels and StayForge. Callback URL in state parameter.

Guest Invitation

Signed JWT in invitation link. Auto-authenticates and redirects on acceptance.

Property Switch

Post-auth property switching with token re-issuance and redirect.

Mobile Deep Link

hotelapp:// protocol handler for mobile app authentication.

Setup

# Clone and run

git clone https://github.com/murrtada/hotel-saas-lab.git

cd hotel-saas-lab

docker compose up --build

# Visit the target

http://localhost:3001

Requires Docker. The lab runs entirely on your machine.

Test Accounts

Username	Password	Role
admin	admin123	System Admin
sarah_manager	password123	Manager
james_reception	password123	Reception Staff

Lab Info

Difficulty: Intermediate
Category: Web / Auth
Target: localhost:3001
Stack: Next.js / Express

Vulnerability Classes

Open Redirect (CWE-601) — V1 regex bypass via double encoding

Token Leakage in URL — access_token in redirect query param

Session Hijacking — replay stolen JWT against API endpoints

Inconsistent Validation — V1 regex vs V2 URL parser disagree

SSO State Manipulation — modify state parameter in SSO callback

CSRF-style Invite Acceptance — invitation JWT in URL, no anti-CSRF token

IDOR on Reservations — /api/reservations/:id lacks ownership check

Debug Endpoint Data Leak — /api/debug/users (X-Forwarded-For bypass)

User Enumeration — /api/auth/check-email (X-Forwarded-For bypass)

CORS Misconfiguration — Access-Control-Allow-Origin: * on SSO routes

Invitation JWT in URL — token exposed in browser history and server logs

Nginx Log Leakage — access tokens logged in plaintext to access.log

JWT Secret Hardcoded in Source — supersecretkey2024 allows token forgery

Objectives

Exploit open redirect via ReturnUrl parameter to leak access tokens
Leak authentication tokens to an external domain
Replay stolen tokens against protected API endpoints
Bypass SSO callback URL validation via state parameter tampering
Identify inconsistencies between V1 and V2 redirect validators
Perform CSRF-style invitation acceptance without consent
Access other users' reservation data via IDOR
Dump all user data from the unauthenticated debug endpoint
Enumerate valid user email addresses via check-email endpoint
Exploit CORS misconfiguration to exfiltrate SSO tokens cross-origin
Extract invitation JWTs from URL parameters and logs
Read Nginx access logs containing leaked tokens
Forge valid JWTs using the hardcoded secret

Based On

Real bug bounty report: Open redirect + access token leakage in hotel SaaS authentication flow. Original finding on YesWeHack (#YWH-PGM43625-11).

Found something?

Submit a writeup on VulnHack documenting your findings, exploit chain, and remediation.

Download Lab Submit Writeup