BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover 🤯

Microsoft (among others) has some gnarly vulnerabilities - where do you all go for bounty programs? Curious even more now seeing how a misconfiguration, lack of ACLs policies, simple cross site scripting execution can bank you some $$$. Disclaimer: I researched a few vendor sites, and while some disclose a method to report, others do not have any information.

aad account account takeover bank bing bingbang bounty cross site scripting cybersecurity information led manipulation microsoft misconfiguration policies report results scripting simple takeover vendor vulnerabilities