Reading a bot username through a CSS :has() oracle that drives window.length across origins, under a CSP with no subresource holes and COOP disabled on plain http
DNS-rebinding an admin bot onto a loopback listener through a PNA-exempt popup to steal the signing key, forge a seller session, then re-run the window.length oracle
Writeup for Append Note from LA CTF 2026. A Web challenge involving Reflected XSS, Prefix Oracle, and CORS misconfiguration.
