Huynh Kien Minh
Information Security professional specializing in Web Application Vulnerability Assessment, Offensive Security, and Red Teaming. Active bug bounty hunter with multiple high-severity CVE disclosures and top rankings across global CTF competitions. Dedicated to securing infrastructure through continuous adversarial exploration.
"role": "Offensive Security Specialist",
"focus": ["Web & API Security", "Active Directory"],
"cve_published": ["CVE-2026-13152", "CVE-2026-12513", "CVE-2026-13157", "CVE-2026-13158", "CVE-2026-13156", "CVE-2026-13736", "CVE-2026-13159"],
"hall_of_fames": ["Proton.me", "Wordfence"],
"mindset": "Break to Build Resilient Systems"
}
# About Huynh Kien Minh
Deep dive into my security philosophy, background, and core technical competencies across the offensive and defensive spectrum.
Offensive Mindset for Defensive Excellence
I am an Information Security student and security practitioner driven by a deep curiosity for how complex systems operate and where their security boundaries break. My approach revolves around proactive verification: finding subtle flaws before malicious actors can exploit them.
Whether participating in international CTF competitions, hunting for vulnerabilities on Bugcrowd and HackerOne, or conducting thorough source code audits, I prioritize actionable remediation, clear documentation, and ethical disclosure.
Technical Core & Competencies
# Certifications & Credentials
7 industry-recognized certifications across Red Teaming, PenTesting, Network, Cloud, and Application Security.
Published Vulnerabilities
A list of Common Vulnerabilities and Exposures (CVEs) that I have identified and responsibly disclosed to affected vendors and security teams.
# Recognized By & Hall of Fame
Honored by leading global tech organizations for responsible vulnerability disclosure and proactive security collaboration.
Honored on the official Proton Mail/Proton Security Hall of Fame for identifying critical privacy and authentication boundaries across encrypted messaging services.
Recognized on the Wordfence Intelligence Vulnerability Database for discovering and disclosing critical security vulnerabilities affecting the global WordPress ecosystem.
Acknowledged for discovering an Unfiltered Deserialization weakness (CWE-502) in the TwitterIdentityProvider Callback.
WordSec
Credited with multiple disclosed vulnerabilities in the WordSec WordPress Vulnerability Database, ranking among the top security contributors.
Credited as Reporter for discovering a Sensitive Authorization Headers & Session Cookies Leakage (CWE-532) via Sentry integration (GHSA-g7g8-qrfj-hqf7).
# Security Research & Writeups
Deep technical analyses of exploit chains, vulnerability deep-dives, and CTF walkthroughs written during personal and academic research.
CVE-2026-12513: Shared Files Unauthenticated Arbitrary File Deletion via Path Traversal
Comprehensive root cause analysis of the single-pass path traversal filter bypass in Shared Files (< v1.7.68). Details how nested sequences exploit frontend upload parameters to trigger permanent deletion of critical server files like wp-config.php.
CVE-2026-13736: NewPath WildApricotPress Add-on Member Directory Unauthenticated PII Disclosure
Deep-dive technical breakdown of the unauthenticated REST route privacy bypass in NewPath WildApricotPress Add-on – Member Directory (<= v1.0.0). Explores missing field-level permission filters, mass member PII leakage, and defensive patch engineering.
CVE-2026-13158: Everest Toolkit Admin+ Arbitrary File Upload to Remote Code Execution
Deep technical advisory analyzing CVE-2026-13158 in Everest Toolkit (<= v1.2.3). Evaluates administrative asset import handlers, missing extension/MIME sanitization in wp_handle_upload routines, exploit mechanics, and defensive engineering patches.
CVE-2026-13157: Theme Demo Import Arbitrary File Upload to Remote Code Execution
In-depth technical advisory on the authenticated arbitrary file upload vulnerability in Theme Demo Import (<= v1.1.3). Evaluates the root cause of disabled MIME verification checks ('test_type' => false in wp_handle_upload), multisite privilege escalation vectors, and secure remediation architecture.
CVE-2026-13152: Custom Fields Account Registration For WooCommerce Unauthenticated Privilege Escalation
Comprehensive root cause analysis and exploit walkthrough of the unauthenticated privilege escalation flaw discovered in Custom Fields Account Registration For WooCommerce (< v1.4). Covers meta key injection mechanics into wp_usermeta, threat modeling, and defensive engineering patch implementation.
CVE-2026-13156: MailerSend SMTP Integration Configuration Deletion via CSRF
Detailed technical analysis of the Cross-Site Request Forgery (CSRF) vulnerability discovered in the MailerSend Official SMTP Integration WordPress plugin (< v1.0.8). Explores the root cause of missing nonce checks on the deletion endpoint, exploit scenario, and official remediation.
# Get In Touch
Have a question about a vulnerability disclosure, interested in collaborating on security research, or seeking a skilled offensive security analyst? Feel free to reach out directly via encrypted channels or email.