Sniffed Xiaohongshu's collection API in 90 seconds—how CORS enabled the hack

A security researcher bypassed Xiaohongshu's CORS protection to access user collection API in 90 seconds.

Published 12sem1 sourceNotable

≈ 14sSpeed

The fact

This flaw exposes common security weaknesses in Chinese mobile APIs.

Click the link to read an article on the topic:

Explore this topic

Accès non autorisé aux données privées des utilisateurs

Auto-synthesis from 1 media source · identified on April 29, 2026