HackerOne Disclosed Reports - 2026-07-21

High
resolved

connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability

Bug reported by Kauã Ferreira was disclosed at July 22, 2026, 4:15 am   |   Improper Verification of Cryptographic Signature

A JWT algorithm confusion vulnerability was reported in the `v1` API of `connect.8x8.com`. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret. The issue was remediated by enforcing RS256 algorithm pinning in the `v1` API verifier.

High
resolved

OAuth redirect uri validation bypass for :proxima_first_party_sync apps

Bug reported by ahacker1 was disclosed at July 21, 2026, 9:43 pm   |   Open Redirect

A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. The vulnerability was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. The vulnerability was reported through the GitHub Bug Bounty program.