Invicti Agentic Pentest uncovers four vulnerabilities in three open-source applications

Why we ran the experiment

Security scanners are easy to evaluate against intentionally vulnerable applications, but real applications are harder. They contain authentication flows, multiple roles, complex deployment requirements, framework behavior, third-party components, and findings that may come from the environment rather than the product itself.

We wanted to understand whether Invicti Agentic Pentest could help with the full security research workflow on real applications across multiple steps:

• Map an unfamiliar application
• Combine runtime behavior with source-code context
• Identify attack paths worth investigating
• Support authenticated testing
• Produce evidence strong enough for responsible disclosure

Rather than maximizing the number of alerts, our goal was to produce reports that maintainers could directly reproduce, evaluate, and fix.

How we ran the research

For each target, we studied the architecture, authentication model, exposed routes, and prior security disclosures. We turned that research into five short supporting documents covering scope, roles, attack surface, test ideas, and historical patterns. The documents were then supplied as the assessment context.

Invicti Agentic Pentest used the provided context to autonomously choose its next test. It moved between source analysis, live application behavior, role-based testing, and browser state, and combined those signals instead of treating each response as an isolated alert. We treated every finding as a hypothesis until the affected role, victim context, and impact had been reproduced or confirmed.

Vulnerabilities identified in open-source applications

Testing Gitea, Tududi, and OrchardCore with Invicti Agentic Pentest produced four vulnerability reports covering stored cross-site scripting (XSS), an API authorization flaw, and an open redirect. Three findings resulted in published GitHub Security Advisories, including two assigned CVEs, while the OrchardCore finding was privately acknowledged by the maintainer. The results illustrate how source-assisted, adaptive testing can uncover security issues in real applications, with human validation and coordinated disclosure forming part of the process.

Gitea stored XSS through repository media serving

Gitea’s Repository Media API returned a repository-controlled HTML file as text/html from the main application origin. The response neither forced a download nor isolated the file on a separate media origin, so opening the media URL executed repository content with Gitea’s origin.

Invicti Agentic Pentest mapped the media route from source, inspected the browser response, formed a same-origin execution hypothesis, and opened the file in an isolated victim browser. That sequence turned an unusual response type into evidence of a browser trust-boundary failure.

JavaScript running in that origin could read data available to the victim and send authenticated same-origin requests. Gitea published the report as GHSA-94rx-fqm6-q23v, rated it High at 8.5, assigned CVE-2026-96594, and listed version 28.1.0 as patched.

Gitea private profile visibility bypass through API routes

Seven API routes under /api/v1/users/{username} omitted the individualPermsChecker middleware used by neighboring routes. A user who marked a profile private could still have their followers, following relationships, SSH keys, GPG keys, starred repositories, and watched repositories exposed to an attacker with a valid token.

Invicti Agentic Pentest compared the privacy behavior of related routes, then traced the missing authorization middleware in source. Having source code context allowed this finding to be reported early in the process. Gitea published GHSA-xvfh-qwmh-f92w, assigned CVE-2026-97859, rated the issue Low, and listed version 1.27.3 as patched.

Tududi open redirect through URL normalization

A request path containing a backslash reached Tududi’s Express static-file middleware. The generated directory redirect preserved the unsafe separator, and browser URL normalization interpreted the result as a network-path reference to an external origin.

The attack required no authentication and produced a trusted Tududi link that redirected the victim to an attacker-controlled site. Because the browser itself performed the normalization after receiving the redirect, the unsafe destination was not visible in the original URL, which made the redirect difficult to detect through server-side validation alone. 

Invicti’s use of a headless browser as an agent tool made it possible to follow the redirect in a browser to establish the final destination rather than relying on the Location header alone. The maintainer published GHSA-m2j3-rgfr-57pq with a Moderate score of 6.1 and listed versions through 1.5.0 as affected.

OrchardCore cross-user stored XSS

A user with delegated permission to manage OrchardCore’s general site settings could store a crafted CdnBaseUrl value that escaped a generated URL attribute and introduced executable markup into pages rendered for other visitors.

Invicti Agentic Pentest validated the write with a restricted settings user and opened the affected page in a separate browser context with no shared session. Script execution for another visitor changed the result from self-XSS to cross-user stored XSS.

The OrchardCore maintainer accepted the report through private disclosure, so implementation-specific reproduction details currently remain private.

Where source-assisted testing added value

Invicti Agentic Pentest was most useful when it connected runtime observations with source-code context. It can explore unfamiliar applications, prioritize suspicious data flows, and form concrete attack hypotheses faster than a purely manual first pass.

Source assistance was especially valuable for behavior spread across multiple stages. Input might enter through one API endpoint, be stored in a database, and appear later in a different page or user context. Dynamic evidence showed that the behavior was reachable, while the source code helped explain why it happened and where the trust boundary failed.

The supporting context documents also helped direct attention toward role boundaries, file-serving behavior, outbound requests, stored content, and historical vulnerability patterns rather than treating every endpoint equally.

Why adaptive agentic pentesting matters

Any assessment performed using Invicti Agentic Pentest also includes rule-based checks and DAST checks, both of which found routes and suspicious responses in these test runs. Agentic Pentest combined signals from source code, identity, permissions, stored state, and browser behavior. These were carried through an iterative test loop to validate trusted-origin execution, private API behavior, URL normalization, and cross-user rendering. Human review remained the disclosure gate.

Assessment cost at Invicti’s introductory pricing

Invicti Agentic Pentest stands out not only for its quality of results but also for its price to performance curve. This cost efficiency is made possible by taking a hybrid DAST/agentic approach that applies AI inference selectively where it produces the best outcomes. 

At the introductory pricing available for Invicti Agentic Pentest through December 31, 2026, each of these evaluations consumed fewer resources than a single standard assessment, which is capped at $500. The assessments yielded real results that led to public advisories and fixes, delivered at a compelling price point.

Conclusion

This research produced three public GitHub Security Advisories and one maintainer-acknowledged report under coordinated disclosure. The strongest result was a High-severity Gitea stored XSS with a CVE. The Tududi open redirect was smaller in impact but still produced a publishable advisory, while OrchardCore demonstrated why role and cross-user testing matter when validating stored XSS.

The findings covered several distinct security failures: same-origin script execution through repository media, API routes that bypassed profile privacy controls, an open redirect caused by URL normalization, and stored XSS affecting users beyond the account that introduced the payload.

Each finding required more than detecting a suspicious response. Invicti Agentic Pentest used source-code context, runtime observations, and browser interactions to investigate potential attack paths and go from hypotheses to reportable results. 

‍

Sources and methodology

• Gitea security advisory GHSA-94rx-fqm6-q23v
• Gitea security advisory GHSA-xvfh-qwmh-f92w
• Tududi security advisory GHSA-m2j3-rgfr-57pq
• Private OrchardCore disclosure acknowledged by the maintainer team on October 1, 2026

Methodology note: Each target was deployed from a known source revision and assessed with authentication where required. Source code and five short supporting documents were attached before assessment started. Findings were reviewed against the source, reproduced independently, tested across relevant user or browser contexts, deduplicated, and disclosed only when the observed impact could be supported.