The three critical vulnerabilities include disclosure of sensitive credentials and configuration, authentication bypass using pre-signed URLs, and subdomain validation bypass.