HackerOne Disclosed Reports - 2026-01-05

Medium
resolved

AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints

Bug reported by Nick Frichette (Datadog) was disclosed at January 5, 2026, 8:38 pm   |   Insufficient Logging

A vulnerability was discovered in the AWS Auto Scaling service, where 6 API endpoints incorrectly reported the user-agent and network information as "AWS Internal" in CloudTrail logs. This allowed the adversary to perform API calls using these endpoints and evade the logging of their IP address and operating system information.

Low
resolved

Stored XSS via SVG Upload in chat.line.biz

Bug reported by Natthakul Raingoen was disclosed at January 5, 2026, 4:49 am   |  

An SVG file containing malicious JavaScript was uploaded to the web application without proper filtering or disabling of embedded scripts. When another user opened the malicious SVG file in the management interface, the embedded script was executed in the browser, resulting in a stored cross-site scripting (Stored XSS) vulnerability.