Offensive security researcher focused on web and browser exploitation. Passionate about uncovering, reproducing, and tinkering with intricate bugs in high-impact, widely used software.

Security Advisories

CVE-2026-24486 - Arbitrary file write via a non-default configuration in python-multipart.
CVE-2026-22256 - Salvo is vulnerable to reflected XSS in the list_html function.
CVE-2026-22257 - Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names.
CVE-2025-58362 - Flaw in URL path parsing could cause path confusion in Hono.
CVE-2025-59139 - Body Limit Middleware Bypass in Hono.
CVE-2025-53535 - Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes in better-auth.
GHSA-hq75-xg7r-rx6c - Routing Bug Can Lead to Cache Deception in better-call.

Bounties

Co-reported 4 critical bugs

Account takeover via XSS in a multi-million-user website, reported through a private program ($4,500 bounty).
Web2/XSS in require_payment function in x402.fastapi.middleware Python package can lead to ATO or funds stealing in github.com/coinbase/x402 ($2,000 bounty).
Web2/XSS in the basic HTML paywall in @x402/express, @x402/hono, @x402/next packages can lead to ATO or Funds Stealing in github.com/coinbase/x402 ($200; severity dispute).
NULL pointer dereference in a blockchain library allowing full denial of service, reported through a private program ($400; scope dispute).

CTF Experience (Awards)

Cyber Odyssey 2024: Secured first place in Cyber Odyssey 2024, the biggest CTF competition in Morocco, winning a total of 80,000 DH with my team FC2MK, focused on Web challenges.
MCSC National CTF 2024: Secured second place with my team FC2MK, winning a total of 10,000 DH, focused on Web challenges.
NULL Hat Morocco 2025: Secured the second place with my team FC2MK focusing on Web challenges.
The International Days of Ethical Hacking (IDEH) v7 CTF: Secured the third place with my team FC2MK, winning a total of 3,000 DH, focusing on Web challenges.

N.B.

All external resources mentioned in all of my writings are included solely for their technical content; the views, backgrounds, or actions of the creators do not reflect my endorsement.

Public PGP key