Skip to main content

Spillhosting.no - Exposed internal dashboard

Created: 25th August 2026

Before publishing this post-mortem, I wanted to confirm I hadn't gotten anything wrong by contacting Spillhosting/Nordic Servers. After that, they blocked me and ignored me. Read more at the end.

Summary​

Spillhosting.no is a game server hosting company (Legal entity: Nordic Servers AS).

Spillhosting.no's admin panel (admin.spillhosting.no) was reachable without authentication if you connected directly to the origin server instead of going through Cloudflare. That gave full access to a dashboard with financial data, customer lists (email, and for some, full name and country), and a feed of recent customer events. I reported this to Spillhosting.no twice, about a month apart, and they fixed it both times. This is my write-up of how the bypass worked.

Timeline​

  • 18th January 2026 - First report sent to Spillhosting.no. Fixed shortly after.
  • 17th February 2026 - The same bypass worked again. Second report sent. Fixed again.
  • 25th August 2026 - My disclosure.

The vulnerability​

admin.spillhosting.no was proxied through Cloudflare, so the subdomain resolved to Cloudflare's edge network instead of the actual server. The origin server itself was still directly reachable from the internet, and nothing on it was checking that requests actually came from Cloudflare.

So the Cloudflare Access sitting in front of the admin panel didn't really matter. If you found the origin IP, you could just talk to the server directly and skip Cloudflare Access completely.

Reproducing it was trivial:

  1. Find the origin server's IP (e.g. 185.244.0.1, example, not the real address). I used Shodan to look for possible addresses.
  2. Add a line to your hosts file so admin.spillhosting.no points to that IP instead of Cloudflare: 
    185.244.0.1 admin.spillhosting.no
  3. Open a browser and go to https://admin.spillhosting.no.
  4. Accept the certificate warning (origin is using Cloudflare's origin certificate, unless a public one is used).
  5. You're in. Full access to the admin dashboard, no login required.

No credentials, no MFA, just a hosts file edit and clicking past a certificate warning.

Impact / what was exposed​

Once Cloudflare was bypassed, the panel showed:

  • Dashboard - Financial revenue graph and a feed of recent customer-related events.
  • Customers - Full list of accounts, email for all of them, full name and country for some.
  • Players - Aggregate player counts per game. Not very sensitive, but still internal data.
  • Invoices - Didn't open this one, but it's probably billing/invoice data given everything else on the panel.

I stopped once I'd confirmed access and didn't dig further than that. No data was downloaded or changed.

Why this is public​

Both reports were fixed, pretty quickly too. Enough time has passed since the second fix that I'm fine writing this up now, mostly because it's a neat example of a Cloudflare-fronted origin that was still directly reachable.

Disclosure conduct​

  • Only did what was needed to confirm and document the vulnerability.
  • No customer data was exported or shared beyond what's written above.
  • Both reports were acted on by Spillhosting.no and fixed each time.

Before publishing​

I contacted Spillhosting and Nordic Servers' email addresses and live chat before publishing this post mortem, to ask if they have anything to add or if I got some facts wrong.
My emails were unanswered, and the live chat icon disappeared for me.
After checking the browser's network traffic, it was clear that I was blocked from live chat.


I was blocked because I was asking for input, as a good gesture.
Even when I initially reported this in January and February, I was met with silence, they just silently fixed it.
No thanks, no response, nothing!