+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: Exploit Log (https://darkcoders.wiki/Forum-Exploit-Log)
+--- Forum: Research Papers/Vulnerability reports (https://darkcoders.wiki/Forum-Research-Papers-Vulnerability-reports)
+--- Thread: HackerOne Disclosed Reports - 2026-07-21 (/Thread-HackerOne-Disclosed-Reports-2026-07-21)
HackerOne disclosed reports - 2026-07-21 - hashXploiter - 07-22-2026
resolved
connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability
Bug reported by Kauã Ferreira was disclosed at July 22, 2026, 4:15 am | Improper Verification of Cryptographic Signature
A JWT algorithm confusion vulnerability was reported in the `v1` API of `connect.8x8.com`. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret. The issue was remediated by enforcing RS256 algorithm pinning in the `v1` API verifier.
resolved
OAuth redirect uri validation bypass for :proxima_first_party_sync apps
Bug reported by ahacker1 was disclosed at July 21, 2026, 9:43 pm | Open Redirect
A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. The vulnerability was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. The vulnerability was reported through the GitHub Bug Bounty program.