HackerOne Disclosed Reports - 2026-07-22

High
resolved

AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF

Bug reported by notnotnotveg was disclosed at July 22, 2026, 7:53 pm   |   Authentication Bypass

Medium
resolved

GitHub user to server tokens can create issues in any public repository

Bug reported by ahacker1 was disclosed at July 22, 2026, 7:39 pm   |   Improper Access Control - Generic

A vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to that repository. This vulnerability was fixed by adding a repository scope check for user-to-server tokens issued by global apps.

High
resolved

connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability

Bug reported by Kauã Ferreira was disclosed at July 22, 2026, 4:15 am   |   Improper Verification of Cryptographic Signature

A JWT algorithm confusion vulnerability was reported in the `v1` API of `connect.8x8.com`. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret. The issue was remediated by enforcing RS256 algorithm pinning in the `v1` API verifier.