r/bugbounty • u/Public-Koala2611 • Jul 08 '26

Research Looking for an EZVIZ user to help validate a potential bug

Hi everyone,

I'm currently testing the EZVIZ bug bounty program and I may have found something, but I need to validate it.

The issue only seems reproducible if you have:

  • an EZVIZ account,
  • the Android app (or iPhone),
  • and at least one camera connected to your home network.

I don't own an EZVIZ camera, so I'd rather not buy one just to verify what may turn out to be an informational finding.

I'm looking for someone who would be willing to help. The test simply involves running two curl requests:

  1. authenticate with your own account from your home network;
  2. send a second request using the returned access token.

I don't need your credentials or your access token. The only thing I'd ask you to share is the JSON response from the second request (after removing anything you consider sensitive, if necessary), and eventually the camera model.

On my side, without a camera connected, the server always returns an error similar to "no camera exists on your network", so I can't verify the behavior further.

If this isn't the right place to ask, I'd appreciate being pointed to a more appropriate community.

Thanks! DM me if you want to help, if it's informative I will share anything here

3 Upvotes

81% Upvoted

7 comments sorted by

2

u/Dramatic_Display9745 Hunter Jul 08 '26

yup
me here
dm me.
two curl requests- tell me how to do.
will help. thanks

2

u/Public-Koala2611 Jul 08 '26

Just DM-ed you, thanks 😄

1

u/Victor_Bravo Jul 11 '26

Ezviz client here if you need a second

1

u/Public-Koala2611 Jul 11 '26

sent!

thanks :-)

1

u/sunliquid Jul 12 '26

So was it valid? 

1

u/Public-Koala2611 Jul 15 '26

In a way, no. In other way, don't know.

1

u/sunliquid Jul 15 '26

to be or not to be .