CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content

Bug reported by Jakub Kozub was disclosed at October 30, 2026, 9:41 pm   |   Improper Authentication - Generic

A vulnerability was discovered in CampTix where the view token used to gate private content was derived from an attendee's email address and the requester's IP address. This allowed an attacker who knew an attendee's email address to gain access to gated content without possessing a valid ticket. The token generation process was performed using data controlled by the requester, making it guessable. Additionally, when a token was requested, the stored token of legitimate ticket holders was overwritten, preventing their access on subsequent visits. The vulnerability affected only installations where the private shortcode feature was deployed.

wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list

Bug reported by Jakub Kozub was disclosed at October 30, 2026, 9:41 pm   |   Open Redirect

A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as an output parameter rather than a limit. This caused all instances of the path prefix to be removed instead of just the leading one. When a specially crafted path containing the prefix twice was requested, the remaining portion could be concatenated with a base URL in a way that altered the authority component, redirecting users to an attacker-controlled destination. The redirect used an unsafe API that performed no destination validation. The vulnerability allowed unauthenticated attackers to bypass the site's SSO redirect allow-list by crafting URLs that appeared to point to the legitimate domain but redirected elsewhere. The impact included silent redirection of users to attacker-controlled hosts with permanent browser caching and legitimate referrer information, creating an effective phishing vector.

launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API

Bug reported by Sahraoui Aymen was disclosed at October 30, 2026, 1:40 pm   |   Improper Authentication - Generic

A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structure validation. During authorization, the server treated these unverified URIs as trusted redirect destinations.

The deprecated implicit grant type was still enabled, which delivered access tokens directly to registered redirects in URL fragments without requiring client authentication or an authorization code exchange. Additionally, the authorization server accepted and honored dangerous redirect URI patterns including cleartext HTTP loopback addresses, custom application schemes, and wildcard hosts and paths.

A victim-bound access token delivered to an attacker-controlled redirect was demonstrated to have full impact across confidentiality, integrity, and availability. The token was used to read the victim's project lists, modify project names server-side with confirmed persistence, and permanently delete victim projects. All operations returned successful HTTP status codes and were verified to have persisted on the server.

Cross-account webhook takeover: PUT and DELETE on //webhooks/.json reach another account's webhook

Bug reported by deivizzzz was disclosed at October 30, 2026, 11:08 am   |   Improper Authentication - Generic

A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhooks belonging to another account when the victim's project was configured with all-access permissions. The vulnerability enabled redirection of webhooks to attacker-controlled servers, allowing interception of sensitive project communications and data.

A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option

Bug reported by deivizzzz was disclosed at October 30, 2026, 11:07 am   |   Improper Access Control - Generic

A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens.

Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:08 am   |   Path Traversal

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such directories were present in component trees. The issue represented a completeness failure in a security hardening mechanism introduced in a prior security fix, affecting multiple code paths including path validation, symlink resolution, backup operations, and component discovery.

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Information Exposure Through an Error Message

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not found resulted in an uncaught exception that printed a full Python traceback to stderr instead of a user-friendly error message. The traceback exposed local absolute paths and internal package information. These issues affected both download and upload operations and were present in release 2.2.0 and the main development branch.

Translation discovery crashes on crafted filenames (regex substitution injection)

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Use of Externally-Controlled Format String

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex engine to raise errors. These uncaught exceptions terminated the entire discovery process for a repository. An attacker with commit access could exploit this to cause a denial of service by committing a single file with a specially crafted name. The vulnerability was fixed by passing wildcard replacements through a callback function instead of string interpolation.