Hackerone Reports

🎯 New Report #3698862: `check reserve proof` sums RingCT ECDH amounts without checking the output commitment
🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-27
⏰ Disclosed: 2026-08-05 10:23:44
📝 Summary: The check reserve proof function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actually exist on-chain.
📂 Report JSON File: 3698862
@hackeronereports

🎯 New Report #3699522: `check reserve proof` counts duplicate entries: one output can inflate `total`
🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-27
⏰ Disclosed: 2026-08-05 10:23:55
📝 Summary: A vulnerability was discovered in the check reserve proof function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue was in the verifier logic, where the accounting was done in a flat manner, adding the output amount for each row without checking for duplicates.
📂 Report JSON File: 3699522
@hackeronereports

🎯 New Report #3687543: `relay tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending tx`
🔺Severity: Critical
👽 Reporter: benisprlh
⭐️ Reputation: 137
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-05 05:05:49
📝 Summary: The relay tx wallet-RPC method in Monero was found to bypass the --restricted-rpc guard, allowing any caller to corrupt the wallet state by submitting a malicious pending tx blob. The issue was that the on relay tx handler did not perform any ownership checks on the supplied pending tx before passing it to commit tx, which then updated the wallet state based on the attacker-controlled data. This vulnerability was introduced in the master branch and was present at the time of the commit analyzed.
📂 Report JSON File: 3687543
@hackeronereports

🎯 New Report #3478646: GitHub Retired UsernameTakeover From [aws/████████](https://hackerone.com/reports/3478646)
🔺Severity: Low
👽 Reporter: sh3d0w
⭐️ Reputation: 719
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2025-12-25
⏰ Disclosed: 2026-08-03 18:17:48
📝 Summary: A retired GitHub username was discovered to be unclaimed, allowing an attacker to register the username and create a repository with the same name as the original. As a result, the original link to the repository now points to the attacker-controlled repository, enabling a persistent repository hijack.
📂 Report JSON File: 3478646
@hackeronereports

🎯 New Report #3514640: Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage
🔺Severity: High
👽 Reporter: howtoplay
⭐️ Reputation: 161
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-01-17
⏰ Disclosed: 2026-08-03 13:35:55
📝 Summary: null
📂 Report JSON File: 3514640
@hackeronereports

🎯 New Report #3878586: Unauthenticated team "income/payments" export ignores donor privacy settings (hide giving, hide from lists) and uses frozen visibility, exposing donat
🔺Severity: Medium
👽 Reporter: its9me
⭐️ Reputation: 171
🛠 State: resolved
💼 Team: Liberapay
💵 Bounty: 100
🕐 Submitted: 2026-07-21
⏰ Disclosed: 2026-08-01 12:27:05
📝 Summary: A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide giving" and "hide from lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment, and ignored the donor's current privacy settings as well as the recipient's opt-in gate. This resulted in the exposure of donations that the donor had since made private or secret.
📂 Report JSON File: 3878586
@hackeronereports

🎯 New Report #3723248: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
🔺Severity: Medium
👽 Reporter: nadav0077
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-07-31 15:27:19
📝 Summary: A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
📂 Report JSON File: 3723248
@hackeronereports

🎯 New Report #3644182: Stored XSS in nameserver field on account settings page
🔺Severity: Low
👽 Reporter: axolot23
⭐️ Reputation: 323
🛠 State: resolved
💼 Team: Tucows (VDP)
💵 Bounty: null
🕐 Submitted: 2026-04-02
⏰ Disclosed: 2026-07-31 15:07:21
📝 Summary: A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
📂 Report JSON File: 3644182
@hackeronereports

🎯 New Report #3815767: Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
🔺Severity: Low
👽 Reporter: sinan-polat
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-21
⏰ Disclosed: 2026-07-30 15:07:10
📝 Summary: A flaw was found in the Node.js Permission Model enforcement that allowed the process.report function to write (and overwrite) files outside the --allow-fs-write paths.
📂 Report JSON File: 3815767
@hackeronereports

🎯 New Report #3553340: Active Storage Vips Transformer Missing validate transformation — CVE-2025-24293 Incomplete Fix
🔺Severity: High
👽 Reporter: friedchicken112211
⭐️ Reputation: 95
🛠 State: informative
💼 Team: Ruby on Rails
💵 Bounty: null
🕐 Submitted: 2026-02-13
⏰ Disclosed: 2026-07-30 13:47:49
📝 Summary: null
📂 Report JSON File: 3553340
@hackeronereports

🎯 New Report #3812439: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)
🔺Severity: Medium
👽 Reporter: vnyuh
⭐️ Reputation: 374
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-19
⏰ Disclosed: 2026-07-30 02:09:47
📝 Summary: A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3812439
@hackeronereports

🎯 New Report #3638909: GitHub scoped user to server tokens can escape their installation
🔺Severity: High
👽 Reporter: ahacker1
⭐️ Reputation: 7591
🛠 State: resolved
💼 Team: GitHub
💵 Bounty: null
🕐 Submitted: 2026-03-31
⏰ Disclosed: 2026-07-29 23:35:21
📝 Summary: An improper authorization vulnerability in scoped user-to-server (ghu ) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26.
📂 Report JSON File: 3638909
@hackeronereports

🎯 New Report #3761342: Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
🔺Severity: High
👽 Reporter: sy2n0
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-25
⏰ Disclosed: 2026-07-29 23:00:05
📝 Summary: A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
📂 Report JSON File: 3761342
@hackeronereports

🎯 New Report #3838601: Permission Model Bypass: `trace events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
🔺Severity: Low
👽 Reporter: 0xoroot
⭐️ Reputation: 922
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-02
⏰ Disclosed: 2026-07-29 14:16:11
📝 Summary: A flaw in Node.js Permission Model enforcement was discovered that allowed trace events.createTracing().enable() to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3838601
@hackeronereports

🎯 New Report #3816840: HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
🔺Severity: Medium
👽 Reporter: yottt
⭐️ Reputation: 457
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-22
⏰ Disclosed: 2026-07-29 14:45:08
📝 Summary: A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
📂 Report JSON File: 3816840
@hackeronereports

🎯 New Report #3577216: `exportReportPdf` mutation shows internal Activity
🔺Severity: High
👽 Reporter: 0v3rw4tch
⭐️ Reputation: 1085
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: null
🕐 Submitted: 2026-02-27
⏰ Disclosed: 2026-07-29 15:01:10
📝 Summary: A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was promptly fixed by enforcing the same per-activity visibility checks and disclosure-level scoping along the export path.
📂 Report JSON File: 3577216
@hackeronereports

🎯 New Report #3473145: Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)
🔺Severity: High
👽 Reporter: button142857
⭐️ Reputation: 147
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2025-12-20
⏰ Disclosed: 2026-07-29 01:48:49
📝 Summary: An SSRF vulnerability was discovered in Rocket.Chat version 7.13.2 that was caused by a DNS rebinding attack. The vulnerability allowed an attacker to bypass a security check and access internal hosts on the same network as the Rocket.Chat server. The vulnerability was present in the SMS integration feature that used the checkUrlForSsrf function, which was bypassed by the DNS rebinding attack.
📂 Report JSON File: 3473145
@hackeronereports

🎯 New Report #3633146: Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh
🔺Severity: Medium
👽 Reporter: mistercloudsec
⭐️ Reputation: 149
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-28
⏰ Disclosed: 2026-07-28 15:29:04
📝 Summary: A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform man-in-the-middle attacks against TLS connections from the sandbox.
📂 Report JSON File: 3633146
@hackeronereports

🎯 New Report #3775702: Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
🔺Severity: Medium
👽 Reporter: nick frichette dd
⭐️ Reputation: 373
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-06-01
⏰ Disclosed: 2026-07-27 19:51:57
📝 Summary: A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior were identified and described in the report.
📂 Report JSON File: 3775702
@hackeronereports

🎯 New Report #3827674: Authentication Bypass via XML Signature Wrapping in SAML SSO
🔺Severity: Critical
👽 Reporter: 0jayden
⭐️ Reputation: 213
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-06-26
⏰ Disclosed: 2026-07-27 16:37:05
📝 Summary: The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the samlp:Response or saml:Assertion. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.
📂 Report JSON File: 3827674
@hackeronereports