A researcher discovered critical vulnerabilities in an Electric Scooter Company's backend after the firm deployed scooters in a Brazilian city. Starting with subdomain enumeration on electricscootercompany.com.br, they found three key hosts: a WordPress marketing site, a REST api, and an Angular painel for operators. The panel exposed 83 endpoints but required authentication. Using the WordPress REST API, the researcher enumerated user admin (slug: electricscootercompany) and confirmed the same identity existed in the operational system. With no rate limiting, a brute-force attack yielded a valid admin password, granting a JWT with level 1000 (admin role) valid for 950 days.

With a valid session, the panel returned operational data for over 408,000 users, fleet maps, docks, garages, geofences, and IoT device inventories. The researcher demonstrated write access by sending POST commands to /iot_sends with `{"pk_veiculo":699,"comando":"open"}`, which physically unlocked a scooter remotely. A friend confirmed the scooter unlocked, lights activated, and it was ride-ready without payment or QR scan. The test was limited to one vehicle; no movement or braking commands were tested.

Dead ends included SQL injection attempts, exposed .git/.env files, and unsigned JWT manipulation — all blocked. The root cause: missing rate limiting and excessive session longevity turned a single known identity into persistent fleet control.