01 / 2024Independent research
Breaking the first-run boundary
Two independently discovered flaws in GoAnywhere MFT turned an initialization route into unauthenticated administrative access.
CVE-2024-0204 · CVE-2024-25156
Open to research, consulting, and roles
Vũ Chí ThànhVulnerability
research
Absence of evidence is not evidence of absence.
Vulnerability researcher building exploits and AI-assisted security tooling.
Ident / vcth4nhFrame / 04
CurrentlyMSc Computing Science studentCyber Security specialisation · Radboud University · 2026–2028
Focus / 01Pre-auth attack surfaces
Practice / 02Web · Mobile · IoT
Output / 03Advisories · Exploits · Tools
Latest activity
Pwn2Own Ireland 2026
Huỳnh Đức Tin and I exploited the Philips Hue Bridge Pro for VinSOC, earning US$40,000.
Read ZDI’s resultsPwn2Own Ireland team placements
- 5th placeVinSOC
- 2nd placeANHTUD
- 1st placeViettel Cyber Security
01
Selected research
Disclosed vulnerabilities with links to advisories and research notes.
02 / 2026Independent research
SAML identity mismatch in authentik
An XML-comment interpretation conflict could bind an attacker's signed external identity to an existing authentik account.
CVE-2026-57580
03 / 2025Independent research
Chaining SSRF into session compromise
An unauthenticated SSRF and improper log neutralization in a-blog cms could be combined to hijack an administrative session.
CVE-2025-36560 · CVE-2025-41429
04 / 2026Co-research · with Ductinn
Unauthenticated RCE in 9Router
Missing authentication exposed privileged functionality; operating-system command injection turned that access into remote code execution.
02
Open-source tools
Tools for code analysis and reverse engineering.
01
IdeSense
Active · 2026An MCP server that gives coding agents access to JetBrains indexing, navigation, diagnostics, and refactoring instead of making them reason from raw files alone.
02
decaf
Active · 2026A sources-first Java decompiler CLI with five engines, automatic fallback, and support for nested archives.
03
Experience
From a part-time research internship to coordinated disclosure, mentoring, and international competition.
01
Jan 2026 - Jul 2026
Cyber Security Specialist
VinSOC
Security Technology Research Department02
Oct 2023 - Jan 2026
Cyber Security Researcher
Viettel Cyber Security
Offensive Security Service Center03
Apr 2024 - Sep 2025
Cyber Security Mentor
Korea Internet & Security Agency
Part-timeSelected competition record
2nd place, Cybersecurity Arena
Security Bootcamp
1st place, ROOTCON 18 CTF
ROOTCON Hacking Conference
Excellent Prize, HackTheon Sejong
Sejong Special Self-Governing City
1st place, ASEAN Cyber Shield
KISA
2nd place, Cyber SEA Game
AJCCBC
04
Homelab
I run a homelab for self-hosted services, monitoring, automation, network segmentation, and local AI experiments.
01Wazuh · Uptime Kuma02n8n · Home Assistant03WireGuard · VLANs04Traefik · Cloudflare05Docker · Virtualization06Local AI · MCP
Get in touch
I’m open to research collaboration, consulting, and full-time roles.
hello [at] thanh [dot] vcuid=vcth4nh · mode=research
I'm Vũ Chí Thành.
Vulnerabilityresearch
Absence of evidence is not evidence of absence.
I investigate authentication, trust boundaries, and complex application behavior, then turn the findings into reproducible security research.
Latest activity
Pwn2Own Ireland 2026
Huỳnh Đức Tin and I exploited the Philips Hue Bridge Pro for VinSOC, earning US$40,000.
Read ZDI’s resultsPwn2Own Ireland team placements
- 5th placeVinSOC
- 2nd placeANHTUD
- 1st placeViettel Cyber Security
01 / CASE FILES
Selected findings
Disclosed vulnerabilities with
advisories and research notes.
FILE_012024
Independent research
Breaking the first-run boundary
Two independently discovered flaws in GoAnywhere MFT turned an initialization route into unauthenticated administrative access.
FILE_022026
Independent research
SAML identity mismatch in authentik
An XML-comment interpretation conflict could bind an attacker's signed external identity to an existing authentik account.
FILE_032025
Independent research
Chaining SSRF into session compromise
An unauthenticated SSRF and improper log neutralization in a-blog cms could be combined to hijack an administrative session.
FILE_042026
Co-research · with Ductinn
Unauthenticated RCE in 9Router
Missing authentication exposed privileged functionality; operating-system command injection turned that access into remote code execution.
02 / WORKBENCH
Tools & traces
Open-source tools for
code analysis and reverse engineering.
Active / 2026
IdeSense
An MCP server that gives coding agents access to JetBrains indexing, navigation, diagnostics, and refactoring instead of making them reason from raw files alone.
KotlinJetBrains PlatformMCP
Active / 2026
decaf
A sources-first Java decompiler CLI with five engines, automatic fallback, and support for nested archives.
PythonJavaCLI
03 / OPEN CHANNEL
Get in touch
I’m open to research collaboration, consulting, and full-time roles.
hello [at] thanh [dot] vc