--

"sats3yhb4xt6" was indeed a valid ID for an invited user, and it was generated by the application. The issue occurred because I used single characters, including random characters and sometimes numbers, in the intruder. This caused the application to randomly cancel other users' invites.

--

--

Muhammad Julfikar Hyder

Red Team Researcher & Security Specialist at Beetles Cyber Security Limited. Co-founder of Bug Bounty Community Bangladesh