Hackerone Reports

🎯 New Report #3676308: POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
🔺Severity: Medium
👽 Reporter: glferreira-devsecops
⭐️ Reputation: 49
🛠 State: resolved
💼 Team: CoinMate.io
💵 Bounty: null
🕐 Submitted: 2026-04-15
⏰ Disclosed: 2026-05-20 09:26:54
📝 Summary: A vulnerability was discovered in the CoinMate API where the POST /api/bitcoinWithdrawalFees endpoint was accessible without authentication, despite being documented as a private endpoint. The endpoint returned real-time Bitcoin withdrawal fee data without requiring any authentication, unlike other private endpoints which correctly rejected unauthenticated requests. The root cause was determined to be a misconfiguration in the authentication middleware that allowed the request to bypass HMAC-SHA256 signature verification. This inconsistency in authentication enforcement indicated a potential configuration error that could affect other recently added or refactored endpoints.
📂 Report JSON File: 3676308
@hackeronereports

🎯 New Report #3572848: Group restriction bypass via bearer token in user oidc (SETTING RESTRICT LOGIN TO GROUPS not enforced in Backend::getCurrentUserId)
🔺Severity: Medium
👽 Reporter: msatz
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-02-25
⏰ Disclosed: 2026-05-21 22:12:59
📝 Summary: A security inconsistency was identified in the user oidc app where group-based login restrictions were enforced in the browser OIDC flow but not in bearer token validation. This could have allowed users outside whitelisted groups to access the Nextcloud API with a valid bearer token.
📂 Report JSON File: 3572848
@hackeronereports

🎯 New Report #3752489: Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)
🔺Severity: High
👽 Reporter: v1ct0rv0nd00m
⭐️ Reputation: 336
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-21
⏰ Disclosed: 2026-05-23 16:05:26
📝 Summary: null
📂 Report JSON File: 3752489
@hackeronereports

🎯 New Report #3736889: NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset
🔺Severity: High
👽 Reporter: junius
⭐️ Reputation: 100
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-15
⏰ Disclosed: 2026-05-23 16:10:45
📝 Summary: null
📂 Report JSON File: 3736889
@hackeronereports

🎯 New Report #3734326: Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check
🔺Severity: High
👽 Reporter: deprrous
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-05-14
⏰ Disclosed: 2026-05-25 14:10:05
📝 Summary: null
📂 Report JSON File: 3734326
@hackeronereports

🎯 New Report #3693295: iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private Tabs
🔺Severity: Medium
👽 Reporter: aaront
⭐️ Reputation: 142
🛠 State: resolved
💼 Team: Brave Software
💵 Bounty: null
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-05-28 15:40:39
📝 Summary: A vulnerability was discovered in the Brave browser for iOS where adding or opening a song in the Brave playlist and holding for the "Open in new Private Tab" option bypassed the Face ID or passcode requirement for accessing Private Tabs. This affected Brave iOS version 1.88 and iOS version 26.4.2. The vulnerability was addressed by Brave to require Face ID when opening a new private tab from the Brave playlist.
📂 Report JSON File: 3693295
@hackeronereports

🎯 New Report #3620753: V2Plugin.Decrypt panics on empty ciphertext (Remote DoS)
🔺Severity: Medium
👽 Reporter: misop00p
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-22
⏰ Disclosed: 2026-05-28 16:35:27
📝 Summary: A vulnerability was discovered in the "aws-encryption-provider" component where the "V2Plugin.Decrypt" function accessed the ciphertext slice without checking if it was empty, leading to a panic and crashing the entire gRPC server process.
📂 Report JSON File: 3620753
@hackeronereports

🎯 New Report #3620748: V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)
🔺Severity: Medium
👽 Reporter: misop00p
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-22
⏰ Disclosed: 2026-05-28 16:40:31
📝 Summary: A vulnerability was discovered in the aws-encryption-provider component of the pkg/plugin/plugin.go file at revision 4341c70. The vulnerability caused the V1Plugin.Decrypt function to panic when passed an empty ciphertext, crashing the entire gRPC server process. This was due to the function accessing the Cipher field without checking if the slice was non-empty.
📂 Report JSON File: 3620748
@hackeronereports

🎯 New Report #3608558: Blind POST SSRF via Web Push Notification Endpoint
🔺Severity: Medium
👽 Reporter: misop00p
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: phpBB
💵 Bounty: null
🕐 Submitted: 2026-03-16
⏰ Disclosed: 2026-05-30 16:47:37
📝 Summary: A vulnerability was discovered in phpBB 4.0.0-alpha1 that allowed registered users to register arbitrary URLs as their Web Push notification endpoint. The endpoint URL was stored without validation and later used by the phpBB server to send outbound HTTP POST requests, potentially leading to blind POST server-side request forgery (SSRF) vulnerabilities.
📂 Report JSON File: 3608558
@hackeronereports

🎯 New Report #3697491: Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template
🔺Severity: None
👽 Reporter: cipher-kid
⭐️ Reputation: 85
🛠 State: informative
💼 Team: Shopify
💵 Bounty: null
🕐 Submitted: 2026-04-26
⏰ Disclosed: 2026-06-01 17:38:27
📝 Summary: null
📂 Report JSON File: 3697491
@hackeronereports

🎯 New Report #3423013: page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
🔺Severity: High
👽 Reporter: imnotr3al
⭐️ Reputation: 353
🛠 State: resolved
💼 Team: LY Corporation
💵 Bounty: 1000
🕐 Submitted: 2025-11-12
⏰ Disclosed: 2026-06-02 03:30:35
📝 Summary: An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. This vulnerability could have been abused within an OAuth 2.0 authorization flow to cause the authorization response to be sent to an attacker-controlled endpoint, potentially exposing the authorization code issued after successful user authentication.
📂 Report JSON File: 3423013
@hackeronereports

🎯 New Report #3775183: Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injection
🔺Severity: High
👽 Reporter: hacker-kartel
⭐️ Reputation: 89
🛠 State: informative
💼 Team: PortSwigger Web Security
💵 Bounty: null
🕐 Submitted: 2026-06-01
⏰ Disclosed: 2026-06-02 15:02:56
📝 Summary: null
📂 Report JSON File: 3775183
@hackeronereports

🎯 New Report #3744200: PHP code injection via unexpected delivery limitation parameter
🔺Severity: High
👽 Reporter: rajib mahmud
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-05-18
⏰ Disclosed: 2026-06-03 13:29:15
📝 Summary: A vulnerability was reported in Revive Adserver 6.0.6 and earlier versions where user input was not properly validated when saving delivery limitations. This allowed a low-privileged user to inject malicious PHP code into the compiledlimitations field, which could then be executed during banner delivery.
📂 Report JSON File: 3744200
@hackeronereports

🎯 New Report #3680090: Stored XSS via malicious usernames in audit log details Username validation bypass in XML‑RPC addUser
🔺Severity: None
👽 Reporter: 3l4
⭐️ Reputation: 135
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-17
⏰ Disclosed: 2026-06-03 13:31:12
📝 Summary: null
📂 Report JSON File: 3680090
@hackeronereports

🎯 New Report #3678828: Banner status override by advertiser‑level users
🔺Severity: Medium
👽 Reporter: v3rtical
⭐️ Reputation: 125
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-16
⏰ Disclosed: 2026-06-03 13:32:11
📝 Summary: A vulnerability was reported in Revive Adserver 6.0.6 and earlier, which allowed an advertiser-level user to activate or deactivate a banner without proper permissions. The issue was caused by the banner-edit.php script, which allowed the banner status to be overwritten solely based on banner edit permissions.
📂 Report JSON File: 3678828
@hackeronereports

🎯 New Report #3677576: Missing access control when modifying parent entities via XML‑RPC
🔺Severity: Medium
👽 Reporter: 3l4
⭐️ Reputation: 135
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-16
⏰ Disclosed: 2026-06-03 13:32:39
📝 Summary: null
📂 Report JSON File: 3677576
@hackeronereports

🎯 New Report #3672641: Session ID reuse allowing XML‑RPC API authentication bypass
🔺Severity: Medium
👽 Reporter: 0x4c616e
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-14
⏰ Disclosed: 2026-06-03 13:33:05
📝 Summary: null
📂 Report JSON File: 3672641
@hackeronereports

🎯 New Report #3669623: Stored XSS via Full Name field in userlog email entries
🔺Severity: Medium
👽 Reporter: 3l4
⭐️ Reputation: 135
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-13
⏰ Disclosed: 2026-06-03 13:33:32
📝 Summary: null
📂 Report JSON File: 3669623
@hackeronereports

🎯 New Report #3656781: PHP code injection via delivery limitation logical
🔺Severity: High
👽 Reporter: 0x4c616e
⭐️ Reputation: 182
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-07
⏰ Disclosed: 2026-06-03 13:33:59
📝 Summary: null
📂 Report JSON File: 3656781
@hackeronereports

🎯 New Report #3653316: Reflected XSS via clientid parameter in zone‑include.php
🔺Severity: Medium
👽 Reporter: titanrain
⭐️ Reputation: 565
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-04-06
⏰ Disclosed: 2026-06-03 13:34:22
📝 Summary: null
📂 Report JSON File: 3653316
@hackeronereports