Extracting YouTube Creator Emails and Spilling Azure Secrets

About this episode

This episode discusses game exploitation, mobile security vulnerabilities, and weaknesses in Azure, including the disclosure of YouTube creator emails.

This episode features some game exploitation in Neverwinter Nights, weaknesses in mobile implementation for PassKeys, and a bug that allows disclosure of the email addresses of YouTube creators. We also cover some research on weaknesses in Azure. Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/278.html [00:00:00] Introduction [00:00:35] Exploiting Neverwinter Nights [00:08:48] PassKey Account Takeover in All Mobile Browsers [CVE-2024-9956] [00:22:51] Disclosing YouTube Creator Emails for a $20k Bounty [00:31:58] Azure’s Weakest Link? How API Connections Spill Secrets [00:39:02] SAML roulette: the hacker always wins [00:40:56] Compromise of Fuse Encryption Key for Intel Security Fuses Podcast episodes are available on the usual podcast platforms: -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz -- Other audio platforms can be found at https://anchor.fm/dayzerosec You can also join our discord: https://discord.gg/daTxTK9

Topics covered

• game exploitation
• YouTube creator email disclosure
• Azure weaknesses
• mobile security
• PassKey vulnerabilities

Keywords

• Neverwinter Nights
• YouTube
• Azure
• PassKeys
• email disclosure
• mobile implementation
• CVE-2024-9956

Mentioned in this episode

Organizations: YouTube, Azure

Products: PassKeys

More episodes of Day[0]

• The Future · April 10, 2026 · 1h 20m
• Exploiting VS Code with Control Characters · May 12, 2025 · 30 min
• Mitigating Browser Hacking - Interview with John Carse (SquareX Field CISO) · April 22, 2025 · 1h 47m
• Pulling Gemini Secrets and Windows HVPT · April 16, 2025 · 1h 33m
• Session-ception and User Namespaces Strike Again · April 1, 2025 · 50 min
• ESP32 Backdoor Drama and SAML Auth Bypasses · March 17, 2025 · 1h 14m