HackerOne Disclosed Reports - 2025-11-21

High
resolved

Improper bot-authentication allows to impersonate any user when sending messages in a room

Bug reported by Stackered was disclosed at November 21, 2025, 7:39 pm   |   Improper Authentication - Generic

A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to match a valid user record.

Low
resolved

Path traversal via archive.extract - CVE 2021-3281 incomplete patch

Bug reported by Stackered was disclosed at November 21, 2025, 7:05 pm   |   Path Traversal

A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect against partial-path traversal. As a result, an attacker could potentially write files outside of the base directory when unzipping archives.