Hackerone Reports

🎯 New Report #3648638: monero:// deeplink parsing accepts tx amount=(all) and can trigger send-all transaction mode
🔺Severity: Medium
👽 Reporter: qttps
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-04
⏰ Disclosed: 2026-08-20 23:47:45
📝 Summary: A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx amount" parameter in the external "monero://" URI handler, which accepted the literal string "(all)" as a valid amount value. This allowed an attacker to bypass the normal numeric amount validation and reach the send-all transaction flow. The vulnerability was present in the current Monero GUI source code at the time of the report.
📂 Report JSON File: 3648638
@hackeronereports

🎯 New Report #3619409: Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution
🔺Severity: High
👽 Reporter: qttps
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-08-20 23:47:52
📝 Summary: A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the p2pool.exe binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.
📂 Report JSON File: 3619409
@hackeronereports

🎯 New Report #3679471: HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 587
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-17
⏰ Disclosed: 2026-08-20 23:49:03
📝 Summary: The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and mislead the victim into confirming a transaction to the attacker's address.
📂 Report JSON File: 3679471
@hackeronereports

🎯 New Report #3686283: View-only offline transaction creation bypasses the long-payment-ID privacy block
🔺Severity: Medium
👽 Reporter: qttps
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-20 23:49:45
📝 Summary: A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction metadata.
📂 Report JSON File: 3686283
@hackeronereports

🎯 New Report #3819475: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field
🔺Severity: Medium
👽 Reporter: lilpeko
⭐️ Reputation: 152
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-06-23
⏰ Disclosed: 2026-08-20 23:51:18
📝 Summary: A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.
📂 Report JSON File: 3819475
@hackeronereports

🎯 New Report #3872858: Stored HTML Injection (CWE-79) via Livechat Visitor Name
🔺Severity: Low
👽 Reporter: hillng
⭐️ Reputation: 126
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-08-20 19:18:46
📝 Summary: null
📂 Report JSON File: 3872858
@hackeronereports

🎯 New Report #3852135: DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)
🔺Severity: High
👽 Reporter: iamaangx028
⭐️ Reputation: 341
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-07-09
⏰ Disclosed: 2026-08-20 19:54:20
📝 Summary: null
📂 Report JSON File: 3852135
@hackeronereports

🎯 New Report #3601469: Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions
🔺Severity: High
👽 Reporter: usagirabbit
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-08-17 09:16:00
📝 Summary: A high-severity access-control issue was found in Monero's ZMQ JSON-RPC surface. When the daemon is started in restricted/public-node mode, the HTTP RPC layer correctly suppresses admin-only methods, but the ZMQ JSON-RPC layer did not inherit or enforce that restriction. This allowed an unauthenticated remote client to invoke state-changing methods that should have been unavailable in restricted mode.
📂 Report JSON File: 3601469
@hackeronereports

🎯 New Report #3620006: Wallet RPC Restricted-Mode Policy Bypass
🔺Severity: High
👽 Reporter: usagirabbit
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-08-17 09:16:13
📝 Summary: A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed to be present in multiple versions of the Monero software.
📂 Report JSON File: 3620006
@hackeronereports

🎯 New Report #3686259: `set daemon` wallet-rpc silently ignores `ssl allowed fingerprints` → pinning bypassed, wallet↔daemon MITM
🔺Severity: High
👽 Reporter: benisprlh
⭐️ Reputation: 139
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-05 05:05:59
📝 Summary: The set daemon JSON-RPC in monero-wallet-rpc was found to have a vulnerability that silently ignored the ssl allowed fingerprints parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the fingerprint list, where the fingerprints were stored as ASCII characters instead of the expected raw SHA-256 digest. This resulted in the verification check always failing, and the connection being accepted by default when ssl support was set to "autodetect".
📂 Report JSON File: 3686259
@hackeronereports

🎯 New Report #3799010: TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
🔺Severity: Medium
👽 Reporter: kuninogu
⭐️ Reputation: 104
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-06-12
⏰ Disclosed: 2026-08-14 14:50:38
📝 Summary: A vulnerability was discovered that allowed an authenticated low-privilege user to cause the trusted Assistant Talk Bot to post attacker-guided AI-generated content into a Talk conversation, even after the user had left the conversation. The issue was caused by the Talk Bot's endpoint trusting the caller-supplied conversation token without verifying that the callback belonged to a task originally scheduled by the bot.
📂 Report JSON File: 3799010
@hackeronereports

🎯 New Report #3829030: Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption
🔺Severity: Low
👽 Reporter: 0xkarim dix
⭐️ Reputation: 1609
🛠 State: resolved
💼 Team: Yelp
💵 Bounty: null
🕐 Submitted: 2026-06-27
⏰ Disclosed: 2026-08-13 13:30:14
📝 Summary: A debug deep link was discovered in the Android application "com.yelp.android.biz" that could be triggered externally, causing the application to crash and the user's session to be invalidated, requiring the user to log in again. The existence of this exposed deep link allowed any malicious application installed on the same device to repeatedly trigger this behavior, resulting in a persistent local denial of service against the application.
📂 Report JSON File: 3829030
@hackeronereports

🎯 New Report #3837634: JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud caller-ID spoofing)
🔺Severity: Medium
👽 Reporter: offseq
⭐️ Reputation: 186
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 500
🕐 Submitted: 2026-07-02
⏰ Disclosed: 2026-08-12 16:07:38
📝 Summary: A vulnerability was discovered in the JaaS SIP gateway that allowed unauthenticated, cross-tenant outbound SIP calling. This could have facilitated toll fraud and caller-ID spoofing.
📂 Report JSON File: 3837634
@hackeronereports

🎯 New Report #3930957: Myndr CORS Misconfiguration
🔺Severity: null
👽 Reporter: hackwithshubh
⭐️ Reputation: 102
🛠 State: resolved
💼 Team: Myndr
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-12 06:22:18
📝 Summary: The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts.
📂 Report JSON File: 3930957
@hackeronereports

🎯 New Report #3265780: Adding phone number to profile By OTP brute forcing
🔺Severity: Medium
👽 Reporter: ganesh reddy
⭐️ Reputation: 428
🛠 State: resolved
💼 Team: CoinMate.io
💵 Bounty: 100
🕐 Submitted: 2025-07-23
⏰ Disclosed: 2026-08-08 09:11:56
📝 Summary: A vulnerability was found that allowed an attacker to add any phone number to a user's profile by brute-forcing the one-time password (OTP) used for phone number verification. The steps involved intercepting the OTP verification request, using a brute-force attack to find the valid OTP, and then replaying the original request with the discovered OTP to complete the phone number addition.
📂 Report JSON File: 3265780
@hackeronereports

🎯 New Report #2551512: [Wii U/3DS/Switch Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE](https://hackerone.com/reports/2551512)
🔺Severity: Low
👽 Reporter: jonbarrow
⭐️ Reputation: 100
🛠 State: duplicate
💼 Team: Nintendo
💵 Bounty: null
🕐 Submitted: 2024-06-13
⏰ Disclosed: 2026-08-07 01:04:12
📝 Summary: null
📂 Report JSON File: 2551512
@hackeronereports

🎯 New Report #3782701: Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
🔺Severity: Critical
👽 Reporter: griffinf
⭐️ Reputation: 1318
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 12000
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-08-05 15:50:21
📝 Summary: A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the exposure of sensitive information such as database credentials, deployment access tokens, and encryption keys.
📂 Report JSON File: 3782701
@hackeronereports

🎯 New Report #3723315: wallet-rpc describe transfer uses real output in tx index instead of real output: cold-wallet pre-sign review shows wrong ring member
🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-08-05 10:23:08
📝 Summary: The wallet-rpc method "describe transfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "real output" index, which represents the position of the real entry in the ring, it used the "real output in tx index", which represents the position of the output in the source transaction. This resulted in the pre-sign review displaying the wrong information about the ring members to the cold-wallet operator. The signing process itself was not affected, as the correct ring members were used when constructing the transaction. The vulnerability was present in the master branch and the release-v0.18 branch of the monero-project/monero repository.
📂 Report JSON File: 3723315
@hackeronereports

🎯 New Report #3700036: SpendProofV1 txid-substitution: get spend proof/check spend proof do not verify returned transaction hash
🔺Severity: Medium
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-28
⏰ Disclosed: 2026-08-05 10:23:21
📝 Summary: A vulnerability was discovered in the Monero project where the get spend proof and check spend proof functions do not verify the returned transaction hash against the requested transaction ID. This allows a malicious or compromised daemon to provide a valid serialized transaction body for a different transaction than the one requested, which can be used to create or verify a spend proof for that different transaction.
📂 Report JSON File: 3700036
@hackeronereports

🎯 New Report #3693636: wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check tx key / check tx proof)
🔺Severity: High
👽 Reporter: bebensap
⭐️ Reputation: 1026
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-08-05 10:23:32
📝 Summary: A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were not always valid, leading to undefined behavior when attempting to access empty data structures. The crash occurred when the wallet software tried to retrieve metadata from the empty response, causing a segmentation fault.
📂 Report JSON File: 3693636
@hackeronereports