Bug bounty

Bug bounty roundup: 15 disclosed reports worth reading

Fifteen HackerOne reports disclosed from 28 October to 7 November 2026, from Basecamp to MariaDB, with what each bug was and the fix it needs.

By Yaali. November 8, 2026, 7 min read, Bug bounty, Vulnerabilities.

This roundup covers 15 bug bounty reports that HackerOne programs made public between 28 October and 7 November 2026. The last two days were quiet, so we widened the window to eleven days and skipped reports an earlier roundup covered. The six MariaDB connector reports and the two Weblate reports share a section each. Researchers are credited by handle with a link to each report, and we summarise without reproducing exploits.

Two patterns repeat. In several reports the authors already knew the right check, because a sibling function performs it, and one code path missed it. In others, client libraries trusted whatever server answered them. None of the 15 reports lists a bounty amount.

Table of nine report groups ranked by severity: Basecamp XSS High 8.7, six MariaDB connector bugs up to 6.9, three WordPress bugs, Monero, AWS VDP, two Weblate reports and Django rated low

Cross-account XSS on Basecamp that beat the CSP

Basecamp embeds media through oEmbed (a standard way for one site to render another site's content). One provider option, a player colour, was written unescaped into an HTML attribute, and the embed's full-page view at /:account/embeds/:sgid/full returned that stored HTML under any account ID, signed in or not. Basecamp's Content Security Policy only runs scripts carrying a per-page nonce. The researcher loaded Basecamp's own Turbo library from its allowlisted asset CDN and let Turbo copy the victim's nonce onto the injected script when it rendered the frame.

From an unrelated account, one opened link gave the attacker the victim's CSRF token and private profile, and let them edit that profile. The lesson: a nonce-based CSP does not cover a frontend library that adopts and re-stamps scripts it is handed, and embed views need the same account check as the rest of the app. Program: Basecamp. Severity: high (CVSS 8.7). Bounty: not disclosed. Reporter: deivizzzz. Report: https://hackerone.com/reports/3981292

Six MariaDB connector bugs where the server is the attacker

Six reports disclosed on 4 November cover MariaDB's client connectors. Two, filed by mschorm and credited to Aisle Research, hit Connector/C up to the 3.4 branch. In the first (CVE-2026-107819), the auth-switch guard tested only the "CA trust failed" bit of the TLS verification status. When only the hostname check failed, a man-in-the-middle could switch the client to the mysql_clear_password plugin and receive the password in plain text. The second is an out-of-bounds read: the GSSAPI plugin copied a server-supplied principal name with strncpy() and never terminated it. Reports: https://hackerone.com/reports/3896617 and https://hackerone.com/reports/3896684

The other four came from fg0x0. The Connector/C++ string escaper moved its search cursor by the length of the replacement and not from the match position, so it re-escaped its own output and broke the quoting of metadata queries, enabling SQL injection (CVSS 6.9). Nine of ten Connector/ODBC catalog functions such as SQLColumns overflowed a 513-byte stack buffer with names over 256 bytes (CVSS 5.7). Connector/ODBC also pasted column names unquoted into the DELETE and UPDATE statements it builds for positioned operations (CVSS 5.7). In r2dbc-mariadb 1.4.1, a packet sent while no command was in flight was queued and handed to the next unrelated query, so with injected bytes one user's rows reached another (CVSS 5.7; CVE-2026-55859 and CVE-2026-55860). Reports: https://hackerone.com/reports/3890289, https://hackerone.com/reports/3891319, https://hackerone.com/reports/3891779 and https://hackerone.com/reports/3920629

The lesson for teams using these drivers: turn on full TLS verification, including the hostname, and update the connectors to releases that carry these fixes. Program: MariaDB. Severity: medium where rated. Bounty: not disclosed.

RSVP list readable past the event password on WordPress events

On events.wordpress.org, recurring GatherPress events are served through a custom REST wrapper. GatherPress core refuses to return the RSVP roster of a password-protected event until the visitor has entered the password. The wrapper route /wp-json/gpre/v1/event/{recurrence_id}/rsvp-responses registered __return_true as its permission callback, so an anonymous request got attendee names, user IDs and profile URLs while the core endpoint answered 401 for the same event.

The fix reuses core's Event::can_read_rsvps() in the wrapper. Program: WordPress. Severity: medium (CVSS 6.9). Bounty: not disclosed. Reporter: 0xbs0d27. Report: https://hackerone.com/reports/4029867

A CampTix access token built from the requester's own IP

The [camptix_private] shortcode hides page content from people without a ticket. A visitor submits an email address; if an attendee record matches, the plugin sets a "view token" cookie equal to an MD5 hash of that email and REMOTE_ADDR. The gate then rebuilds the expected token from the same email and the same IP, both supplied by whoever is asking. Anyone who knew an attendee's address could read the gated content in one POST, with no nonce and no confirmation mail. It also overwrote the real attendee's token, logging them out.

The fix proposed is a random stored token, with the access link mailed to the address so that the request proves control of the inbox. Program: WordPress. Severity: medium (CVSS 6.3). Bounty: not disclosed. Reporter: jakubk. Report: https://hackerone.com/reports/4043537

A str_replace() mistake gave wordpress.org an open redirect

The theme behind wordpress.org/openverse/ redirects visitors to the standalone Openverse site by stripping the /openverse prefix from the path and appending the rest to a bare origin. The code passed 1 as the fourth argument to PHP's str_replace(), believing it limited the call to one replacement. That argument is an output that reports how many replacements happened. Every /openverse in the path was removed, so a crafted path turned the target into https://openverse.wordpress.net@evil.example/, whose real host is the part after the @. The link's host is wordpress.org, so it also passed the SSO login redirect allowlist.

The fix is a true prefix strip with str_starts_with() and substr(), plus wp_safe_redirect() so no future slip can point off-site. Program: WordPress. Severity: medium (CVSS 6.1). Bounty: not disclosed. Reporter: jakubk. Report: https://hackerone.com/reports/3933198

A Monero wallet RPC that believed a remote node

monero-wallet-rpc can run against a remote node, which it treats as untrusted unless started with --trusted-daemon. Its rescan_spent handler asked the node which outputs were spent and overwrote the wallet's own flags with the answer, without the is_trusted_daemon() check that simplewallet and the import_key_images handler both perform. A malicious node could mark a spent output as unspent. When the wallet next spent it, the node held two rings sharing the same key image, and intersecting them reveals the real input. No funds are lost, since the network rejects the double spend.

The fix is the trust check its siblings already have. Program: Monero. Severity: medium (CVSS 5.3). Bounty: not disclosed. Reporter: offsetmd. Report: https://hackerone.com/reports/3719670

The open source strands-agents tools ask a human operator to approve dangerous actions. The prompt was rendered through prompt_toolkit's HTML(), which treats markup in the text as formatting. An attacker who steered a tool argument through indirect prompt injection could hide part of it with a <hidden> tag or matching foreground and background colours. The use_computer tool passed its app_name argument into shell, PowerShell and AppleScript commands, so an operator who approved a harmless-looking prompt ran the hidden command.

The fix: render approval text as plain text and pass argument vectors, not shell=True. The author notes it is distinct from CVE-2026-18733, which the archive lists against it. Program: AWS VDP. Severity: medium. Bounty: not disclosed. Reporter: hope_no_dupe. Report: https://hackerone.com/reports/4077800

Two ways to tie up Weblate's translation-finder

Weblate uses the translation-finder library to discover translation files in a repository it pulls; anyone who can add a component can point it at their own repository. sumit-sabhaya found that the Qt .ts sniffer parsed files with Python's expat and allowed entity declarations. A file of 957,496 bytes stayed under expat's amplification ratio cap but still forced about 55 MB of expansion, 0.866 seconds per file against 0.006 for a normal one, and each crafted file was parsed once (CVE-2026-62326). The fix is an EntityDeclHandler that rejects every entity. Report: https://hackerone.com/reports/4094236

robin-sabhaya found that wildcard mask matching scanned the whole bucket of files sharing a suffix once per result, which made discovery quadratic: 4,000 files took 10.79 seconds and 8,000 took 45.78. Report: https://hackerone.com/reports/4088592

Program: Weblate. Severity: medium. Bounty: not disclosed.

Django's cache treated absent and empty headers alike

Django's CacheMiddleware builds the page cache key from the request headers named in a response's Vary header. It produced the same key whether a header was missing or present with an empty value, although RFC 9111 says those are different requests. In the proof of concept, a view that returned a private response when X-Scope was present cached it for a request sending X-Scope: empty, then served it to a request with no such header.

It only matters for apps that branch on whether a header is present. Program: Django. Severity: low. Bounty: not disclosed. Reporter: dogeshark. Report: https://hackerone.com/reports/4062511

What to check in your own code

When you add a route, wrapper or RPC handler, diff it against its closest sibling and look for the check the sibling has. Treat database and blockchain servers as untrusted input in client code, with hostname verification on. For parsers of uploaded files, cap total work per job, not only per file.

Our web application penetration testing tests authorization across accounts and roles, and red team code review reads the source for missing checks like these. Open the chat and Yaali, our AI agent, will pass your question to an engineer.