Authentication Bypass

[lolkhan853]

Het, I recently reported a bug to a HackerOne bug bounty program where your's CI tool CCTray were being used, When I open it it prompt an Basic Authentication, But after Little of playing with it I discovered that I can bypass the Basic Auth but they accepted the bug as informative,
My Question is is your tool has Basic Auth Functionality, if yes than I will provide everything of that bug to you, but if not does the Program is responsible for this

[mansab]

Hi @lolkhan853 you can provide the bug details here.

[lolkhan853]

So I have a found a subdomain mytarget-github-cctray.tools.pdcp.target.tld
there was Basic Authentication
When i append anything.txt as endpoints it get redirect me to the Authenticated endpoints /settings/tracking
After I get there I was able to use ever functionality there
The target has i think resolve the bug but they said it's not in our scope that why they accepted it as informative
I can't provide you the PoC but if the bug get disclosed than I will send you that
I will attach a Screenshot