Hackerone Reports

🎯 New Report #3558277: Fail-Open in set tlsext servername callback on pyopenssl via unhandled exceptions leads to security bypass
🔺Severity: Low
👽 Reporter: uv3doble
⭐️ Reputation: 154
🛠 State: resolved
💼 Team: Python Cryptographic Authority
💵 Bounty: null
🕐 Submitted: 2026-02-16
⏰ Disclosed: 2026-03-20 16:10:03
📝 Summary: A vulnerability was discovered in the pyopenssl library's handling of the Server Name Indication (SNI) callback (set tlsext servername callback). The internal wrapper for this callback catches all Python exceptions raised by user code but returns 0 (Success/SSL TLSEXT ERR OK) to the underlying OpenSSL engine. This behavior allowed a TLS connection to be successfully established even when the security validation logic inside the callback crashed or raised an exception, potentially bypassing critical access controls or authentication mechanisms implemented at the SNI layer.
📂 Report JSON File: 3558277
@hackeronereports

🎯 New Report #3604288: Access to Deactivated LinkedIn Company Pages via Competitor Analytics API
🔺Severity: Medium
👽 Reporter: riadalrashed
⭐️ Reputation: 724
🛠 State: resolved
💼 Team: LinkedIn
💵 Bounty: null
🕐 Submitted: 2026-03-14
⏰ Disclosed: 2026-03-24 10:31:54
📝 Summary: A vulnerability was discovered in LinkedIn's Competitor Analytics API that permitted authenticated users to access analytics data for deactivated company pages.
📂 Report JSON File: 3604288
@hackeronereports

🎯 New Report #3592387: Potential Subdomain Takeover on IBM.com domain.
🔺Severity: High
👽 Reporter: bugmithalchemist
⭐️ Reputation: 144
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-03-08
⏰ Disclosed: 2026-03-24 15:25:47
📝 Summary: A potential subdomain takeover on an IBM.com domain was reported to IBM, analyzed, and remediated.
📂 Report JSON File: 3592387
@hackeronereports

🎯 New Report #3542546: Server-side ReDoS via user-controlled regex in OIDC Access Policy
🔺Severity: null
👽 Reporter: 6b jjj
⭐️ Reputation: 542
🛠 State: resolved
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2026-02-06
⏰ Disclosed: 2026-03-26 09:31:22
📝 Summary: The OIDC Access Policy implementation evaluated user-supplied regular expressions against JWT claim values using Ruby's Regexp engine without any timeout or complexity validation. The vulnerable code path was Regexp.new(value).match?(claim value), where value was fully user-controlled and claim value was derived from JWT claims. Malicious regular expressions with catastrophic backtracking characteristics could be supplied, causing the server to spend an excessive amount of CPU time evaluating a single request.
📂 Report JSON File: 3542546
@hackeronereports

🎯 New Report #3546390: Assertion error in node url.cc via malformed URL format leads to Node.js crash
🔺Severity: Medium
👽 Reporter: rafaelgss
⭐️ Reputation: null
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-09
⏰ Disclosed: 2026-03-26 15:41:58
📝 Summary: An assertion error in node url.cc via malformed URL format leads to a Node.js crash. A flaw in the URL processing caused an assertion failure in the native code when url.format() was called with a malformed internationalized domain name containing invalid characters, crashing the Node.js process. This vulnerability affected Node.js versions 24.x and 25.x.
📂 Report JSON File: 3546390
@hackeronereports

🎯 New Report #2439734: Missing policies for password in password policies.go
🔺Severity: null
👽 Reporter: sinic
⭐️ Reputation: 102
🛠 State: informative
💼 Team: passhash
💵 Bounty: null
🕐 Submitted: 2024-03-28
⏰ Disclosed: 2026-03-27 07:15:27
📝 Summary: null
📂 Report JSON File: 2439734
@hackeronereports

🎯 New Report #2441029: Potential DoS due to PasswordPoliciesNotMet in errors.go
🔺Severity: Low
👽 Reporter: sinic
⭐️ Reputation: 102
🛠 State: informative
💼 Team: passhash
💵 Bounty: null
🕐 Submitted: 2024-03-29
⏰ Disclosed: 2026-03-27 07:16:28
📝 Summary: null
📂 Report JSON File: 2441029
@hackeronereports

🎯 New Report #3523703: Password Strength Policy Bypass via Server-Side Validation Flaw
🔺Severity: Low
👽 Reporter: 2026
⭐️ Reputation: 2301
🛠 State: resolved
💼 Team: Tucows (VDP)
💵 Bounty: null
🕐 Submitted: 2026-01-25
⏰ Disclosed: 2026-03-27 19:49:57
📝 Summary: A password strength policy bypass was discovered due to a server-side validation flaw. The password strength policy was only enforced in the browser, not on the server side.
📂 Report JSON File: 3523703
@hackeronereports

🎯 New Report #3531737: Memory leak in Node.js HTTP/2 server via WINDOW UPDATE on stream 0 leads to resource exhaustion
🔺Severity: Medium
👽 Reporter: galbarnahum
⭐️ Reputation: 173
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-01-30
⏰ Disclosed: 2026-03-30 16:41:57
📝 Summary: null
📂 Report JSON File: 3531737
@hackeronereports

🎯 New Report #3449392: CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown
🔺Severity: Low
👽 Reporter: wooseokdotkim
⭐️ Reputation: 116
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2025-12-03
⏰ Disclosed: 2026-03-30 16:42:05
📝 Summary: null
📂 Report JSON File: 3449392
@hackeronereports

🎯 New Report #3560402: Denial of Service via ` proto ` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)
🔺Severity: High
👽 Reporter: yushengchen
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-18
⏰ Disclosed: 2026-03-30 16:42:13
📝 Summary: null
📂 Report JSON File: 3560402
@hackeronereports

🎯 New Report #3559715: Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`
🔺Severity: Medium
👽 Reporter: xavlimsg
⭐️ Reputation: 551
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-17
⏰ Disclosed: 2026-03-30 16:42:22
📝 Summary: null
📂 Report JSON File: 3559715
@hackeronereports

🎯 New Report #3533945: Timing side-channel in HMAC verification via memcmp() in crypto hmac.cc leads to potential MAC forgery
🔺Severity: Medium
👽 Reporter: x probe
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-01
⏰ Disclosed: 2026-03-30 16:42:57
📝 Summary: null
📂 Report JSON File: 3533945
@hackeronereports

🎯 New Report #3480841: Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
🔺Severity: Low
👽 Reporter: stif
⭐️ Reputation: 149
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2025-12-28
⏰ Disclosed: 2026-03-30 16:44:00
📝 Summary: null
📂 Report JSON File: 3480841
@hackeronereports

🎯 New Report #3511792: HashDoS in V8
🔺Severity: Medium
👽 Reporter: sharp edged
⭐️ Reputation: 136
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-01-15
⏰ Disclosed: 2026-03-30 16:44:09
📝 Summary: null
📂 Report JSON File: 3511792
@hackeronereports

🎯 New Report #3634571: Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes
🔺Severity: Medium
👽 Reporter: tipsen
⭐️ Reputation: 909
🛠 State: resolved
💼 Team: arkadiyt-projects
💵 Bounty: null
🕐 Submitted: 2026-03-28
⏰ Disclosed: 2026-03-31 02:04:58
📝 Summary: A path traversal vulnerability was discovered in the protodump tool. The vulnerability allowed an attacker to influence the output filename construction and bypass the containment check, enabling writes outside the intended output directory. The vulnerability was caused by the use of descriptor-controlled paths in the output filename construction, along with an unsafe lexical prefix check for directory containment. This issue has been identified in the protodump tool.
📂 Report JSON File: 3634571
@hackeronereports

🎯 New Report #3634400: SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)
🔺Severity: High
👽 Reporter: tipsen
⭐️ Reputation: 909
🛠 State: resolved
💼 Team: arkadiyt-projects
💵 Bounty: null
🕐 Submitted: 2026-03-28
⏰ Disclosed: 2026-03-31 02:31:50
📝 Summary: A vulnerability was discovered in the ssrf filter library version 1.3.0. The library failed to block the NAT64 local-use IPv6 prefix 64:ff9b:1::/48, allowing such addresses to be treated as public. This enabled SSRF requests through /fetch to targets encoded under that prefix when routable in the deployment environment.
📂 Report JSON File: 3634400
@hackeronereports

🎯 New Report #3479692: Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
🔺Severity: null
👽 Reporter: eclipse07077
⭐️ Reputation: 95
🛠 State: informative
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2025-12-27
⏰ Disclosed: 2026-03-31 12:03:51
📝 Summary: null
📂 Report JSON File: 3479692
@hackeronereports

🎯 New Report #3240792: Reported RPC Overflow
🔺Severity: null
👽 Reporter: jehrenhofermagicgrants
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2025-07-08
⏰ Disclosed: 2026-04-06 17:23:22
📝 Summary: A stack buffer overflow was reported in the Monero RPC server. Specifically, on line 1291 of the core rpc server.cpp file, an overflow could occur if the size of the b.data() did not match the size of the crypto::key image. Additionally, a missing return statement was found following line 1289. The issue was detected through fuzzing performed by Ada Logics on behalf of the MAGIC Monero Fund.
📂 Report JSON File: 3240792
@hackeronereports

🎯 New Report #3241102: Reported Denial of Service
🔺Severity: null
👽 Reporter: jehrenhofermagicgrants
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2025-07-08
⏰ Disclosed: 2026-04-06 17:23:31
📝 Summary: A vulnerability was reported in the Monero RPC server that could cause a denial of service. The issue was found in the "calc pow" RPC endpoint, where specially crafted input could cause the server to crash with the message "Cryptonight variant 1 needs at least 43 bytes of data". The problem was that the function did not properly validate the length of the input data, leading to an unexpected exit condition.
📂 Report JSON File: 3241102
@hackeronereports