Adel Assakaf عادل السقاف

Security researcher. Vulnerability research written up end to end: advisories, CVEs and open-source contributions.

• [CVE-2026-52848] MFA Bypass via REQUEST_URI Substring Match in GLPI: isAPI() matches api.php anywhere in REQUEST_URI, so appending ?x=api.php to the login endpoint skips the MFA gate. A valid password alone yields a fully authenticated session.
• [CVE-2026-59206] Prototype Pollution to Unauthenticated User Enumeration in n8n: A two-level dynamic write in replaceInvalidCredentials pollutes Object.prototype from a default Member account, so req.user resolves for unauthenticated requests and every account email, role and MFA status leaks.
• Privilege Escalation to Superuser in Paperless-ngx: A type-coercion slip in UserViewSet let any account holding auth.add_user create a full superuser. Published as GHSA-59xh-5vwx-4c4q, CVSS 7.1.
• Contribution to ProjectDiscovery's httpx: On interrupt, httpx saved a resume index based on dispatched targets, not completed ones, silently skipping 51 of 108 hosts on resume. PR #2393 makes shutdown drain in-flight work first.
• Contribution to Turbot's Steampipe (Google Workspace): Added an Admin Reports table to the Steampipe Google Workspace plugin: query Workspace audit logs (logins, admin actions, OAuth tokens, Drive, mobile) as SQL for detection and compliance. PR #88, merged.