A detailed bug bounty writeup describing a four-vulnerability chain that achieves one-click account takeover. The chain combines: (1) a DOM XSS sink in a React error page that passes an unvalidated backURL query parameter to window.location.assign; (2) an Akamai WAF bypass using bracket-notation property access (top["setTimeout"]) to avoid keyword-paren adjacency detection; (3) window.name cross-origin smuggling to deliver the payload without it ever appearing in the inspected URL; and (4) abuse of a first-party authentication SDK that exposes methods returning signed JWTs and live AWS STS credentials to any executing JavaScript. The result: nine webhook hits in 8 seconds, yielding full session metadata, a signed RS256 JWT containing PII, and temporary credentials for two separate AWS accounts. Key takeaways include modeling WAF rules structurally rather than brute-forcing variants, the persistent cross-origin nature of window.name, and how global auth SDKs dramatically escalate XSS severity beyond simple cookie theft.
