Bug bounty

Bug bounty roundup: 10 disclosed reports worth reading

By Yaali. November 12, 2026, 8 min read, Bug bounty, Vulnerabilities.

Ten HackerOne reports disclosed from 14 October to 11 November 2026: a RubyGems takeover, a HEY desktop redirect, a Burp Suite NTLM leak and more.

This roundup collects ten bug bounty reports that HackerOne programs disclosed publicly between 14 October and 11 November 2026. The researchers found the bugs, the programs fixed them, and the write-ups then became public. We credit every finding to the named researcher by handle and link the original report. The two archives we read held only two full write-ups from the last 48 hours, so the window widened to about four weeks, skipping anything an earlier roundup covered.

Two patterns run through the set. The first is a guard that names one case and forgets its sibling: RubyGems checked ownership on the direct invite route but not the gem transfer route, and curl guarded one branch of credential handling and not the branch below it. The second is trusting your own domain too much, where an open redirect on app.hey.com, a shared-cookie subdomain of aws.dev, and an unlinked Essity registration page each turn that trust into the attack. Only one of the ten reports lists a bounty.

Privilege escalation: a RubyGems admin becomes an owner through gem transfer

timhaines found that an organization admin on RubyGems.org, the package registry for Ruby, could reach the owner role through the gem transfer flow. That flow authorizes against an admin-only "add gem" check, then copies the selected owner role into a new membership, skipping the policy that refuses an admin granting ownership on the normal invite route. By transferring a gem into the organization and setting a controlled account to owner, the attacker could then evict the real members and lock them out of publishing. A May 2026 fix added the ownership check to the direct members controller but left the transfer controller uncovered. Program: RubyGems. Severity: high (CVSS 7.0). Bounty: not disclosed. Reporter: timhaines. Report: https://hackerone.com/reports/3938927

HTML injection: a Burp Suite error log leaks a Windows NTLM hash

gankd reported that Burp Suite 2026.8 wrote an OpenAPI parser error into its Event log as raw HTML without encoding the attacker-controlled text. A crafted API response raises an error whose message carries an injected image tag pointing at a remote file over Server Message Block (SMB, the Windows file-sharing protocol). When the tester saves the response to the site map and clicks the log row, Burp authenticates to the attacker's SMB endpoint, exposing a NetNTLMv2 challenge-response, the output of Windows NTLM authentication, which an attacker can crack offline. The fix is to HTML-encode every dynamic log value and stop the view fetching external resources. Program: PortSwigger. Severity: medium. Bounty: $1,000. CVE: CVE-2021-29416 (a regression of that class). Reporter: gankd. Report: https://hackerone.com/reports/3972558

Open redirect: a single capital letter turns HEY's own domain against it

nasrysami showed that app.hey.com, the Basecamp email service, compared a URL scheme case-sensitively in its proxy_image endpoint. A lowercase https:// was proxied, but HTTPS://, the same scheme by the standard, was not recognised, so the endpoint redirected the visitor to the raw address. That open redirect matters because the HEY desktop app decides a link is safe to load in an app window by asking only whether it is on app.hey.com. A crafted link genuinely is, passes the test, then redirects to the attacker's page, which renders in a chromeless window with no address bar, ready to show a fake sign-in prompt. The fix normalises the scheme before proxying. Program: Basecamp. Severity: medium (CVSS 6.1). Bounty: not disclosed. Reporter: nasrysami. Report: https://hackerone.com/reports/3972760

notnotnotveg found an unauthenticated go-httpbin instance, a request-echoing testing server, on a subdomain of aws.dev. Its /cookies/set endpoint let anyone set a cookie with an arbitrary Domain, including the parent aws.dev, so a cookie planted from one subdomain was sent to unrelated sibling applications. This cookie tossing forces attacker-chosen cookies onto neighbouring sites that share a parent domain. One crafted value made a sibling return a CloudFront firewall 403, a denial of service against a single victim, and such cookies can shadow real security cookies. The same server also offered an open redirect. A debugging tool that reflects input does not belong on a production domain whose siblings share cookies. Program: AWS VDP. Severity: medium. Bounty: not disclosed. Reporter: notnotnotveg. Report: https://hackerone.com/reports/3966599

Missing authentication: an Essity supplier portal left its registration page open

ousski read a JavaScript file on an Essity subdomain that referenced an /Account/Register route the interface never links. Requesting it directly returned a working form that asked for no invitation, no supplier code and no proof of any Essity relationship. A self-supplied email, the confirmation link, and the forgotten-password flow produced a live account on an internal procurement portal, whose own requests returned real vendor records on login. Any party on the internet could read supplier data and use the foothold as a pretext for social engineering. The fix requires an invitation and verifies affiliation before an account sees data. Program: Essity. Severity: medium. Bounty: not disclosed. Reporter: ousski. Report: https://hackerone.com/reports/4071064

Denial of service: one oversized file exhausts a Weblate scanner

sumit-sabhaya traced a memory exhaustion bug in translation-finder, the library Weblate uses to discover translation files in a repository it pulls. Its encoding sniffer read the whole file into memory with no size limit, while every other sniffing path stops at one mebibyte. A single 128 mebibyte file pushed a run's peak memory to about 403 mebibytes, enough for the Linux out-of-memory killer to end a worker on a small container. Discovery runs automatically after each version-control update, so anyone who can push to a watched repository triggers it. The fix reads a bounded sample, the cap the sibling sniffers already use. Program: Weblate. Severity: medium; the reporter scores it CVSS 3.7 to 5.5 depending on who can start the scan. Bounty: not disclosed. Reporter: sumit-sabhaya. Report: https://hackerone.com/reports/4028616

Credential leak: curl hands a Kerberos ticket to a redirect target

giant_anteater reported that libcurl could send a live Negotiate token, the Kerberos single sign-on ticket used across corporate networks, to a host it never meant to authenticate to. curl has a guard that stops credentials following a redirect to a different origin. A May 2026 refactor gated only the option-supplied credential branch and left the branch that reads a username and password from the URL ungated, so a redirect whose Location header carries any userinfo, even junk, short-circuits the guard. The Negotiate token is minted from the client's own Kerberos session, so the attacker needs no real credential, only a server the victim follows with --negotiate, and can replay the captured ticket to impersonate the victim. The fix gates the URL branch too. Program: curl. Severity: tracked as CVE-2026-86413; the archive lists no CVSS. Bounty: not disclosed. Reporter: giant_anteater. Report: https://hackerone.com/reports/3993549

Mail header injection: a two-character escape smuggles headers into Roundcube

dogeshark found that Roundcube, the webmail client Nextcloud bundles, stripped carriage return and line feed characters from address input, then ran a C-style unescape on the recipient display name. Those characters, written CRLF, separate one mail header from the next. The user submits the literal sequence backslash-r, which carries no control character past the strip, and the unescape turns it into a real carriage return afterward. The Simple Mail Transfer Protocol layer that moves mail between servers then promotes that lone character to a line break on the wire. An authenticated user can inject headers, forging From and Sender from a domain whose sender-authentication records the server satisfies. The fix unescapes before sanitizing, not after. Program: Nextcloud. Severity: rated none by the program, though the impact is sender spoofing. Bounty: not disclosed. Reporter: dogeshark. Report: https://hackerone.com/reports/3913007

Business logic: a Nextcloud calendar accepts any appointment time

0xh3llo showed that Nextcloud's public appointment booking checks that some bookable slot exists inside the requested window, then saves the raw requested time rather than the validated slot. The service searches about a day around the start, finds a real slot anywhere in it, treats that as proof, then persists the attacker's values instead. An unauthenticated holder of a shared booking link can set a start on an unavailable day, stretch the end to sweep in a genuine slot, and land a confirmed event off-hours, even in the past. The same flaw defeats the conflict check and the daily maximum. The fix requires the requested time to match an offered slot exactly. Program: Nextcloud. Severity: low (CVSS 3.7). Bounty: not disclosed. Reporter: 0xh3llo. Report: https://hackerone.com/reports/3943436

Stored XSS: a WordPress Classic block revives an encoded payload

pinkdraconian reported stored cross-site scripting, which runs attacker code in another user's browser, in a WordPress development build that had dropped a setting disabling an old editor path. An Author saves an image whose data-wp-more attribute holds an entity-encoded payload, kept safely as text. When an Administrator later edits the post in the Classic block and selects the image, the editor decodes that attribute and inserts it into the element-path interface as live HTML, so a nested image tag with an error handler runs script in the Administrator's session. It fires only on the unreleased build, not shipped 7.1.3, so it is a warning caught before release. A value decoded for display must be re-encoded at that boundary. Program: WordPress. Severity: not rated; it existed only in a development build. Bounty: not disclosed. Reporter: pinkdraconian. Report: https://hackerone.com/reports/4100259

What to take from this batch

When you fix one route to a privileged action, check every other route that reaches it. The RubyGems takeover and the curl credential leak are each one branch carrying a check its sibling lacks, and the Weblate scanner is one sniffer missing the size cap the others have. Look next at where your own domain is treated as inherently safe, since an open redirect, a shared-cookie subdomain or an unlinked registration page each turns that trust into the attack. And validate the value you actually store or send, not merely that a valid one exists nearby.

Our web application penetration testing works through signup, redirect and authorization flows like the Essity, HEY and RubyGems reports, and red team code review reads source for incomplete fixes and missing input checks like the curl and Roundcube bugs. Open the chat and Yaali, our AI agent, will pass your question to an engineer.