Three modest flaws added up to an admin-portal takeover path at a pet-care startup
A fast-growing pet-care services startup. Outcome verified
The problem
A fast-growing pet-care startup had built a web-based administrative back end for its customer app. Leadership knew a growing customer base raised the stakes, but nobody had ever tried to break into the company's custom code or its public website. The engineering team was small, and the third-party login service ignored the app's own lockout rules.
Why it mattered
The admin portal controlled customer and pet-care records, so a takeover would expose customer data. The public website could be hijacked or used to attack others.
What we did
Vizius rated findings by how they chained together rather than in isolation. User enumeration, unlimited login attempts and no multi-factor authentication were each modest alone, but together formed a practical account-takeover path. Findings were explained in developer terms, MFA was switched on while testing was under way, and Vizius informally retested after fixes shipped.
What changed
The retest confirmed that brute-force lockout, a cleartext login page, public exposure of user data and a privilege-escalation flaw were fixed and MFA was in place.
- Retail and consumer
- Small company