HackerOne Disclosed Reports - 2026-10-15

Medium
resolved

Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow

Bug reported by NasrySami was disclosed at October 15, 2026, 6:00 pm   |   Open Redirect

A case-sensitive URL scheme comparison flaw in the proxy image endpoint allowed open redirects on the mail service's web domain. The endpoint failed to recognize uppercase HTTPS scheme variants and redirected users to unproxied URLs instead of properly proxying them. When combined with the desktop application's internal-origin allowlist, this flaw could be exploited to load attacker-controlled content within a desktop application window that lacked address bar indicators. The vulnerability was accessible without authentication and could be delivered through ordinary messages containing specially crafted links. A similar case-sensitive scheme comparison issue was identified in the inbound mail image rewriter, though no impact was demonstrated in that location. The flaw affected desktop versions on multiple platforms and was fixed through proper URL parsing and normalization of schemes before deciding whether to proxy requests.

Medium
resolved

Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB authentication

Bug reported by Pedro Cruz was disclosed at October 15, 2026, 2:08 pm   |  

A vulnerability was discovered in Burp Suite where attacker-controlled text from an OpenAPI parser exception was inserted into the Event log HTML without proper encoding. When a user invoked a specific save function and selected the resulting Event log entry, malicious HTML tags were interpreted by the HTML editor. On Windows systems, this allowed the execution of file URL requests that triggered SMB authentication to attacker-controlled endpoints. The vulnerability required user interaction including two specific UI actions to be exploited.

High
resolved

An organization admin can create an attacker-controlled organization owner via the gem transfer flow

Bug reported by Tim Haines was disclosed at October 15, 2026, 7:09 am   |   Improper Access Control - Generic

An organization administrator was able to create an attacker-controlled organization owner through the gem transfer flow, bypassing the security policy that normally restricted owner role creation to existing owners. This privilege escalation allowed the attacker to remove legitimate organization members and publishers, and prevent them from publishing gems they previously had access to through their organization membership.

High
resolved

[Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack

Bug reported by moe_hw was disclosed at October 15, 2026, 1:14 am   |   Stack Overflow

A stack-based buffer overflow vulnerability was discovered in local wireless networking functionality. The vulnerability could be exploited through crafted network traffic to execute arbitrary code using return-oriented programming techniques.