🎯 New Report #4071670: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks
🔺Severity: Low
👽 Reporter: sujitjaunjal
⭐️ Reputation: 199
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 200
🕐 Submitted: 2026-09-30
⏰ Disclosed: 2026-10-08 10:21:14
📝 Summary: A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier after the user authenticated. The monitoring service was configured with sampling at 100 percent and no URL sanitization callback, resulting in every reset token being recorded. The token was a live, single-use credential that could be used to reset any account without further authentication. A previously reported similar issue affecting a different telemetry service had been patched with path-specific redaction, but this left the same vulnerability open through an alternate monitoring sink that was not covered by that remediation.
📂 Report JSON File: 4071670
@hackeronereports