How A Simple Bug That Refused to Die, Paid Twice. 💰

A bug bounty hunter discovered a reflected text injection vulnerability in a Swiss insurance company's email confirmation endpoint. Although XSS payloads were blocked, plain text input was reflected on the page, enabling social engineering attacks on a trusted verification flow. After reporting and receiving a bounty, the researcher found the same vulnerability persisted in the password reset flow due to an incomplete fix, earning a second payout. The key takeaway: developers often patch one endpoint while forgetting similar ones, and hunters should always re-test related flows after a fix is applied.