Hackerone Reports

🎯 New Report #3664261: Reflected Cross-Site Scripting (XSS) found on IBM.com domain
🔺Severity: null
👽 Reporter: entrovyx
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-04-10
⏰ Disclosed: 2026-06-15 15:42:13
📝 Summary: A reflected Cross-Site Scripting (XSS) vulnerability was found on the IBM.com domain. The vulnerability was reported to IBM, analyzed, and remediated. The external researcher who reported the issue was acknowledged.
📂 Report JSON File: 3664261
@hackeronereports

🎯 New Report #3717354: UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding Authen
🔺Severity: None
👽 Reporter: hacker-kartel
⭐️ Reputation: 84
🛠 State: resolved
💼 Team: PortSwigger Web Security
💵 Bounty: null
🕐 Submitted: 2026-05-06
⏰ Disclosed: 2026-06-15 09:21:46
📝 Summary: A vulnerability was discovered in Burp Suite MCP Server BApp v1.2.1 where the addAutoApproveTarget function failed to validate the hostnames passed to it. This allowed a malicious MCP client to inject a comma-separated hostname, which was then persisted as multiple independent allow-list entries. As a result, the user-approval dialog and the persistence layer disagreed on the target scope, leading to a consent bypass.
📂 Report JSON File: 3717354
@hackeronereports

🎯 New Report #3712279: Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling
🔺Severity: High
👽 Reporter: kawakatz
⭐️ Reputation: 594
🛠 State: resolved
💼 Team: PortSwigger Web Security
💵 Bounty: 5000
🕐 Submitted: 2026-05-04
⏰ Disclosed: 2026-06-14 08:08:52
📝 Summary: A vulnerability was discovered in Burp Suite Professional 2026.3.3 on Windows. When Burp Scanner's browser-powered crawler crawled an attacker-controlled website, the website could force Burp to write an attacker-controlled file to an attacker-controlled local path. The issue was caused by Burp's handling of file input fields, where Burp created a local upload file from page-controlled attributes but did not prevent path traversal in the generated filename.
📂 Report JSON File: 3712279
@hackeronereports

🎯 New Report #3781015: Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions
🔺Severity: High
👽 Reporter: shinchan 69
⭐️ Reputation: 240
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-06-12 09:46:19
📝 Summary: null
📂 Report JSON File: 3781015
@hackeronereports

🎯 New Report #3558713: Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`
🔺Severity: High
👽 Reporter: inkerton
⭐️ Reputation: 87
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-02-17
⏰ Disclosed: 2026-06-11 16:54:20
📝 Summary: null
📂 Report JSON File: 3558713
@hackeronereports

🎯 New Report #3619287: RCE Supply Chain Attack via pull request target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers
🔺Severity: Critical
👽 Reporter: 6r1ff1n
⭐️ Reputation: 94
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-06-11 14:28:34
📝 Summary: A vulnerability was discovered in the DuckDuckGo content-scope-scripts repository's GitHub Actions workflow. The workflow used the pull request target trigger without access controls, allowing untrusted code from fork pull requests to be checked out and executed. This could have led to remote code execution and the potential exfiltration of sensitive information, such as API keys, on the runner. The vulnerability also could have been exploited to manipulate the automated release pipeline, potentially compromising all DuckDuckGo browsers and extensions across multiple platforms.
📂 Report JSON File: 3619287
@hackeronereports

🎯 New Report #3619288: RCE PAT Exfiltration via pull request target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers
🔺Severity: Critical
👽 Reporter: 6r1ff1n
⭐️ Reputation: 94
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-06-11 14:30:26
📝 Summary: A vulnerability was discovered in the "auto-respond-pr.yml" GitHub Actions workflow of the "privacy-configuration" repository. The workflow used the "pull request target" trigger, which checked out the fork's repository as both the "base" and "PR" branches. This allowed an attacker to control the code executed by the workflow, leading to arbitrary code execution and the exposure of the "PRIVACY CONFIG PAT" secret. The exposed token was likely used for PR auto-approval, enabling the attacker to approve their own PRs and access private repository contents. The vulnerability also resulted in the unconditional exposure of additional secrets, such as "ASANA ACCESS TOKEN" and "GH RO PAT", when a fork PR was closed.
📂 Report JSON File: 3619288
@hackeronereports

🎯 New Report #3738654: Firecracker Out-of-bounds Read/Write Local Privilege Escalation Vulnerability
🔺Severity: None
👽 Reporter: terrynini38514
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-05-15
⏰ Disclosed: 2026-06-11 15:00:03
📝 Summary: A vulnerability was discovered in Firecracker versions up to 1.15.1 that could allow a malicious guest to bypass protection mechanisms and perform out-of-bounds read and write operations on the virtio PCI queue. The vulnerability was caused by inconsistencies in the handling of queue activation state during snapshot restore, which could lead to the reactivation of already validated queues with stale pointers, enabling the guest to mutate the queue configuration and trigger out-of-bounds access.
📂 Report JSON File: 3738654
@hackeronereports

🎯 New Report #3393664: SSRF via improper validation after DNS name resolution in the link-preview feature
🔺Severity: High
👽 Reporter: button142857
⭐️ Reputation: 147
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2025-10-22
⏰ Disclosed: 2026-06-11 11:52:25
📝 Summary: The link-preview feature in Rocket.Chat version 7.11.0 did not properly validate the IP address after DNS resolution. This allowed an attacker to obtain a domain that pointed to an internal IP address, triggering SSRF and enabling access to internal hosts that would otherwise be unreachable.
📂 Report JSON File: 3393664
@hackeronereports

🎯 New Report #3383079: SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function
🔺Severity: Medium
👽 Reporter: button142857
⭐️ Reputation: 147
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2025-10-14
⏰ Disclosed: 2026-06-11 11:52:32
📝 Summary: A vulnerability was discovered in Rocket.Chat version 7.10.1 where the oEmbed feature did not properly validate redirected URLs. This allowed an attacker to bypass SSRF protections and access internal network resources that would otherwise be unreachable.
📂 Report JSON File: 3383079
@hackeronereports

🎯 New Report #2389431: Action Text ReDoS (Ruby 3.1 or lower)
🔺Severity: Low
👽 Reporter: ooooooo q
⭐️ Reputation: 1581
🛠 State: resolved
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2024-02-25
⏰ Disclosed: 2026-06-09 04:37:55
📝 Summary: A vulnerability was discovered in the ActionText component of the Rails web framework for Ruby versions 3.1 and lower. The vulnerability was caused by a Regular Expression Denial of Service (ReDoS) issue in the plain text for blockquote node method. This method was used in the ActionText::Fragment#to plain text functionality. The vulnerability could be triggered by crafting malicious text and calling the to plain text method. The vulnerability was resolved in later versions of Ruby.
📂 Report JSON File: 2389431
@hackeronereports

🎯 New Report #3599248: Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter
🔺Severity: Medium
👽 Reporter: marioniangi
⭐️ Reputation: 98
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-03-12 09:57:06
📝 Summary: A bypass was discovered for a previously patched open redirect vulnerability on a web application. The original fix blocked certain payloads, but failed to account for path traversal sequences combined with double slashes. By supplying a specific redirect value, an attacker could still redirect authenticated users to arbitrary external domains. The vulnerability was caused by an incomplete denylist approach rather than proper validation.
📂 Report JSON File: 3599248
@hackeronereports

🎯 New Report #3578842: SQL Injection vulnerability found on ibm.com endpoint
🔺Severity: Critical
👽 Reporter: cr3ckerxploit
⭐️ Reputation: 160
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-02-28
⏰ Disclosed: 2026-03-12 18:54:29
📝 Summary: A SQL injection vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.
📂 Report JSON File: 3578842
@hackeronereports

🎯 New Report #3507241: Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signing
🔺Severity: Medium
👽 Reporter: aszx87410
⭐️ Reputation: 216
🛠 State: resolved
💼 Team: MetaMask
💵 Bounty: 350
🕐 Submitted: 2026-01-12
⏰ Disclosed: 2026-03-13 01:42:13
📝 Summary: A critical security vulnerability was discovered in the Starknet Snap by Consensys. The vulnerability allowed malicious websites to bypass user authorization when signing messages or transactions. The vulnerability existed in the enableAuthorize parameter, which could be controlled by any website. When set to false, the confirmation dialog was not shown to the user, allowing a malicious website to sign arbitrary messages or transactions without user approval.
📂 Report JSON File: 3507241
@hackeronereports

🎯 New Report #3467641: Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure
🔺Severity: Low
👽 Reporter: perxibes
⭐️ Reputation: 117
🛠 State: resolved
💼 Team: Basecamp
💵 Bounty: 100
🕐 Submitted: 2025-12-16
⏰ Disclosed: 2026-03-16 04:36:39
📝 Summary: A vulnerability was discovered where unauthenticated users could access private files and file previews on the application through Active Storage URLs. This vulnerability allowed information disclosure, as the files and previews could be accessed without any authentication or authorization checks.
📂 Report JSON File: 3467641
@hackeronereports

🎯 New Report #3591764: Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan Subscription
🔺Severity: Medium
👽 Reporter: ziadmomen
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2026-03-08
⏰ Disclosed: 2026-03-16 12:00:45
📝 Summary: A business logic vulnerability was identified that allowed users on a free plan to generate an invitation link that assigned the "Read Access" role, which was intended to be restricted to users with a Pro Plan subscription. The vulnerability was triggered by manipulating the invitation creation process to bypass the subscription-based permission restrictions.
📂 Report JSON File: 3591764
@hackeronereports

🎯 New Report #3475626: Session Cookie Leakage via Static Header Field in WebViewerFragment
🔺Severity: High
👽 Reporter: dphoeniixx
⭐️ Reputation: 2424
🛠 State: resolved
💼 Team: LinkedIn
💵 Bounty: null
🕐 Submitted: 2025-12-22
⏰ Disclosed: 2026-03-17 06:13:57
📝 Summary: A vulnerability was identified in the "WebViewerFragment" that could lead to the leakage of the user's cookies. The root cause was a static field ("CUSTOM HEADERS") that persisted cookies across different URL loads, allowing an attacker to steal the victim's session cookies. The vulnerability was demonstrated through a complex exploitation chain involving chaining multiple weaknesses.
📂 Report JSON File: 3475626
@hackeronereports

🎯 New Report #3378540: Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
🔺Severity: Low
👽 Reporter: theokeen
⭐️ Reputation: 13878
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: null
🕐 Submitted: 2025-10-10
⏰ Disclosed: 2026-03-18 12:47:07
📝 Summary: A vulnerability was discovered in the reward redemption process of a points and rewards system. The vulnerability allowed an attacker to obtain multiple valid Burp Suite Pro licenses by using different email addresses, without any validation or verification tied to the user's account. The email contained a link to redeem the reward, which directed the user to a Google Form. After submitting the form with different email addresses, the attacker received multiple valid licenses. The lack of proper identity verification before issuing the license, and the absence of rate limiting or CAPTCHA, enabled the abuse of the reward system.
📂 Report JSON File: 3378540
@hackeronereports

🎯 New Report #3522254: PATs without the required scope can leak issues
🔺Severity: Medium
👽 Reporter: s3rdz0
⭐️ Reputation: 5826
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-03-19 18:47:58
📝 Summary: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token (PAT) lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user must have had existing access to the repository through organization membership or as a collaborator for the vulnerability to be exploitable.
📂 Report JSON File: 3522254
@hackeronereports

🎯 New Report #3025797: [Privilege Escalation User can Pin|Unpin Any Comment on Any Project or Locale](https://hackerone.com/reports/3025797)
🔺Severity: Low
👽 Reporter: adilnbabras
⭐️ Reputation: 268
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: null
🕐 Submitted: 2025-03-07
⏰ Disclosed: 2026-03-20 11:00:15
📝 Summary: A vulnerability was discovered in the Pontoon application where any user could pin or unpin comments on any project or locale, despite lacking the necessary privileges. This was possible due to the lack of proper access controls in the backend code handling the pin and unpin functionality.
📂 Report JSON File: 3025797
@hackeronereports