Bybit EU — DOM XSS → 0-click ATO

Vulnerability: /en-EU/fiat/trade/narkasa/verification?start_url=javascript:
Attacker-side proof of concept · HackerOne bybit_fintech · asset *.bybit.eu

0-CLICK: For non-Turkish Bybit EU users, the XSS fires automatically after page load. The Narkasa API returns is_narkasa: false → window.location.href = start_url executes without any button click or user interaction.

Authorised security testing. This page demonstrates a reported vulnerability using only the tester's own account. The relay server redeems the token and reads the account — proving full ATO from a context with zero victim cookies.

Step 1 — 0-click XSS trigger

While logged into www.bybit.eu (non-Turkish account), click the button. The Bybit page loads, checks Narkasa status, gets is_narkasa: false, and automatically navigates to the javascript: URI — no click needed.

Open vulnerable page (0-click)

Payload URL (for review):

Bybit EU — DOM XSS → 0-click ATO

Step 1 — 0-click XSS trigger

Step 2 — Or paste the token

Chain progress

Account data (from attacker context)

Raw API responses