HackerOne Disclosed Reports - 2026-09-01

High
resolved

connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

Bug reported by Kauã Ferreira was disclosed at September 2, 2026, 12:03 am   |   External Control of Critical State Data

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation.

Critical
resolved

connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

Bug reported by Kauã Ferreira was disclosed at September 1, 2026, 11:51 pm   |   Deserialization of Untrusted Data

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a `JsonSerializer` with attacker-controlled `TypeNameHandling` settings, enabling deserialization of arbitrary .NET types. The issue was addressed by projecting HTTP responses to plain JavaScript values before template evaluation, removing all Newtonsoft object exposure from the template scope.

High
resolved

Ticket Trick Attack allows access to Rockstar Games' workspaces

Bug reported by Abhishek Awasthi was disclosed at September 1, 2026, 7:03 pm   |   Improper Access Control - Generic

A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting access on the support portal.