HackerOne Disclosed Reports - 2026-08-20

Medium
resolved

Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

Bug reported by jonathan untario was disclosed at August 20, 2026, 11:51 pm   |  

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.

Medium
resolved

View-only offline transaction creation bypasses the long-payment-ID privacy block

Bug reported by .. was disclosed at August 20, 2026, 11:49 pm   |   Information Disclosure

A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction metadata.

Medium
resolved

HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

Bug reported by Yalguun Tumenkhuu was disclosed at August 20, 2026, 11:49 pm   |   Code Injection

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and mislead the victim into confirming a transaction to the attacker's address.

High
resolved

Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

Bug reported by .. was disclosed at August 20, 2026, 11:47 pm   |   Improper Access Control - Generic

A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.

Medium
resolved

monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

Bug reported by .. was disclosed at August 20, 2026, 11:47 pm   |   Business Logic Errors

A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which accepted the literal string "(all)" as a valid amount value. This allowed an attacker to bypass the normal numeric amount validation and reach the send-all transaction flow. The vulnerability was present in the current Monero GUI source code at the time of the report.

Medium
resolved

Loss of multisig funds through single malicious participant's deliberate deception

Bug reported by k-privacy-enjoyer was disclosed at August 20, 2026, 11:47 pm   |   Business Logic Errors

A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately select the same inputs when re-creating a transaction.

High
resolved

DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

Bug reported by Aang was disclosed at August 20, 2026, 7:54 pm   |   NoSQL Injection

Low
resolved

Stored HTML Injection (CWE-79) via Livechat Visitor Name

Bug reported by Hill N was disclosed at August 20, 2026, 7:18 pm   |   Cross-site Scripting (XSS) - DOM