SAMPLE FORMAT — not a client report · COMPONENT: SECURITY DISCLOSURES
SEVERITY · CRITICAL (WIZ'S RATING)
Private apps accepted self-registration through two unauthenticated endpoints.
- Issue
- Anyone holding a private app's
app_id— which is public — could register and verify an account, bypassing the app's SSO. - Reproduction
- As published by Wiz Research. Wiz verified the platform fix on 10 Jul 2025, so this sample records that re-test rather than a working exploit.
- Remediation
- Platform side: Wix shipped the fix within 24 hours of the 9 Jul 2025 report, and Wiz verified it on 10 Jul. App side: review the users who registered on the app on or before 9 Jul 2025, as Wiz suggests.
- Source
- Wiz Research, published 29 Jul 2025 (read 23 Sep 2026).
A client report uses these fields for every finding, with reproduction steps run against your app.