Vyntra Research

Offensive research, articles and writeups.

The research work behind Vyntra — advisories, vulnerability analysis and the technical details of the flaws we find.

9 min read@rafabd1

Beyond the hackbot: how AI-assisted vulnerability research works

Why heuristics, steering, evidence, and persistent memory matter more than raw volume when searching for real vulnerabilities.

Read →
13 min read@rafabd1

Invisible Prompt Injection Chain Leading to Private Conversation Data Exfiltration

How invisible Unicode, a remote second stage, and external browsing can turn public content into an exfiltration channel.

Read →
7 min read@rafabd1

Prototype-Based Tool Allowlist Bypass in Vercel AI SDK MCP Client

How an inherited-property check allowed unapproved MCP tools to be exposed and executed.

Read →
3 min read@rafabd1

Next.js Vulnerability: Accessing Protected Static Routes in App Router via RSC Segment Artifacts

An internal build artifact in Next.js let attackers reach content protected by proxy/middleware without authentication (CVE-2026-44575).

Read →
2 min read@rafabd1

Bypassing BODY_SIZE_LIMIT in SvelteKit adapter-node via chunked requests

How chunked requests without Content-Length bypassed the body size limit in SvelteKit's adapter-node (CVE-2026-40073).

Read →
5 min read@rafabd1

Prompt Injection in Bug Bounty: Vectors, Techniques, and Real-World Impact

A practical guide to indirect injection attacks and real-world impact.

Read →