🔺Severity: High
👽 Reporter: kyotozzx
⭐️ Reputation: 306
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 1337
🕐 Submitted: 2026-06-13
⏰ Disclosed: 2026-07-22 04:15:44
📝 Summary: A JWT algorithm confusion vulnerability was reported in the
v1 API of connect.8x8.com. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret. The issue was remediated by enforcing RS256 algorithm pinning in the v1 API verifier.📂 Report JSON File: 3800870
@hackeronereports