0x0doteth is the online handle of Balvant Chavda (also known as Chavda Balvant), an independent cybersecurity researcher from India. Under this handle, he has published 11+ CVEs affecting Adobe Commerce, Adobe Content Credentials, and Nextcloud, and has been acknowledged in security Hall of Fame programs by Google, Microsoft, Apple, Meta, Amazon Web Services, Adobe, GitHub, Intel, Coinbase, PayPal, Salesforce, and over 25 other organizations. His website is balvant.in and his HackerOne profile is hackerone.com/0x0doteth.

Who is Balvant Chavda?

Balvant Chavda (online handle: 0x0doteth) is an independent security researcher and bug bounty hunter from India. He specializes in web application security, mobile security, smart contract auditing, and cloud security. He has discovered 11+ CVEs and received 25+ Hall of Fame acknowledgements from major organizations including Google, Microsoft, Apple, Meta, AWS, and Adobe. His research is published at balvant.in.

What CVEs has 0x0doteth discovered?

0x0doteth (Balvant Chavda) has discovered 11+ CVEs including: CVE-2025-66513 and CVE-2025-66515 (Nextcloud), CVE-2026-21309, CVE-2026-34647, CVE-2026-47996, CVE-2026-47984, CVE-2026-71362 (Adobe Commerce), CVE-2026-45159, CVE-2026-45280, CVE-2026-45283 (Nextcloud), and CVE-2026-47922 (Adobe Content Credentials).

0x0doteth / Security researcher / India

Assume nothing.Trust no input.

I'm Balvant Chavda, also known as 0x0doteth on HackerOne, security advisories, and bug bounty platforms. I research vulnerabilities in mobile apps, web applications, cloud services, and smart contracts.

Read my research See my CVEs

Android securityiOS securityWeb applicationsSmart contractsCVE researchCloud Android securityiOS securityWeb applicationsSmart contractsCVE researchCloud

Recent write-ups

Bugs I found and how they worked.

$Dithered cobalt poster of an investigator approaching a fractured glass portal$ Published

01 / AndroidJan 2025

Mobile application security

When WebView bites back

An exported Android activity loaded attacker-controlled content in a WebView and allowed JavaScript execution.

Vector: Exported activity
Outcome: JavaScript execution

Read the write-up

Dithered cobalt poster of an ancient mint producing an endless stream of blank coins

Published

02 / Web3Mar 2025

Smart contract security

The function that could mint forever

A missing authorization check allowed the contract to mint tokens without a supply limit.

Vector: Missing authorization
Outcome: Unlimited minting

Read the write-up

Dithered cobalt poster of a courier facing three diverging routes

Published

03 / MobileDec 2024

Identity and deep links

How a news app leaked OAuth codes

A conflicting Android deep link let another app receive an OAuth authorization code.

Vector: Deep-link collision
Outcome: Code interception

Read the write-up

Dithered cobalt poster of a hidden breach beneath a monumental archive

Published

04 / WebNov 2023

Web application security

SQLi: finding to exploitation

How I confirmed a SQL injection, demonstrated database impact, and reported it responsibly.

Vector: Unsafe input
Outcome: Database access

Read the write-up

Assigned vulnerabilities · Discovered by Balvant Chavda (0x0doteth)

Assigned CVEs.

CVE-2025-66513Research record

NextcloudSecurity advisoryPublished 02

CVE-2025-66515Research record

NextcloudSecurity advisoryPublished 03

CVE-2026-21309Research record

AdobePublic advisoryPublished 04

CVE-2026-34647Research record

Adobe CommerceAPSB26-49Published 05

CVE-2026-45159Research record

NextcloudSecurity advisoryPublished 06

CVE-2026-45280Research record

NextcloudSecurity advisoryPublished 07

CVE-2026-45283Research record

NextcloudSecurity advisoryPublished 08

CVE-2026-47996Research record

Adobe CommerceAPSB26-73Published 09

CVE-2026-47984Research record

Adobe CommerceAPSB26-73Published 10

CVE-2026-71362Research record

Adobe CommerceAPSB26-92Published 11

CVE-2026-47922Research record

Adobe Content CredentialsAPSB26-111Published

Security acknowledgements

Hall of fame and thanks received.

25+

Organizations

Organizations that acknowledged or credited my vulnerability reports.

GoogleTechnology

MicrosoftTechnology

AppleTechnology

MetaTechnology

AWS

Amazon / AWSCloud

AdobeCreative technology

NextcloudOpen-source cloud

IntelHardware

GitHubDeveloper platform

CoinbaseFinancial technology

PayPalPayments

SalesforceEnterprise cloud

PhilipsHealth technology

NCIIPCGovernment

UK GovernmentGovernment

Dutch GovernmentGovernment

VismaEnterprise software

LenskartRetail technology

ReckittConsumer health

Baloise InternationalInsurance

RobecoAsset management

RechtspraakJudiciary

ResMedMedical technology

Bloom & WildCommerce

EvriLogistics

About

Who is 0x0doteth?

0x0doteth is the security research handle of Balvant Chavda (also written as Chavda Balvant). Balvant is an independent cybersecurity researcher from India, specializing in vulnerability discovery, bug bounty hunting, and responsible disclosure.

Under the handle 0x0doteth, Balvant has published 11+ CVEs affecting products from Adobe Commerce, Adobe Content Credentials, and Nextcloud. He has been acknowledged in security Hall of Fame programs by Google, Microsoft, Apple, Meta, Amazon Web Services, Adobe, GitHub, Intel, Coinbase, PayPal, Salesforce, and over a dozen other organizations.

The username 0x0doteth appears on HackerOne, Adobe Security Bulletins, Nextcloud Security Advisories, and GitHub security advisories as a credited researcher.

Read the full profile of Balvant Chavda (0x0doteth) →

Books and notes