Type: Sensitive data exposure via static generation · Severity: High (CVSS 8.2) · Reported to a private bug-bounty program via HackerOne.

Target details are redacted per coordinated-disclosure rules. This write-up covers the technique only.

The finding

A per-user dynamic route (a referral feature) was pre-rendered by Next.js Static Site Generation into publicly reachable JSON under _next/data. Appending .json to a username exposed internal profile metadata — including the internal userId UUID — with no authentication.

Reproduction (pattern)

1. Grab the current build id from the page HTML:

curl -s "https://app.example.tld/" | grep -oP '"buildId":"\K[^"]+'

1. Confirm sensitive accounts exist (HTTP 200 = pre-rendered and present):

curl -I -H "x-nextjs-data: 1" \
  "https://app.example.tld/_next/data/<BUILD_ID>/<locale>/referrals/admin.json"

1. Extract a user's data, including the internal UUID:

https://app.example.tld/_next/data/<BUILD_ID>/<locale>/referrals/<username>.json

Impact

• Privileged-account disclosure — confirming admin/support accounts exist provides prime targets for social engineering and credential stuffing.
• Internal UUID leakage — these ids feed authenticated calls elsewhere in the platform, enabling targeted IDOR and session-hijacking follow-ups.
• Mass harvesting — a common-name wordlist dumps metadata for the entire referral user base.

Remediation

• Validate the session inside getStaticProps/data logic for per-user pages; do not statically render private per-user data.
• Never serialize internal database UUIDs into client-side JSON caches.
• Block direct access to _next/data/ unless the request comes from a valid authenticated session.