HackerOne Disclosed Reports - 2026-10-28

High
resolved

Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM

Bug reported by Connor Carro was disclosed at October 28, 2026, 8:13 pm   |   Uncontrolled Resource Consumption

Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.

High
resolved

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

Bug reported by deivizzzz was disclosed at October 28, 2026, 4:58 am   |   Cross-site Scripting (XSS) - Generic

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with a content security policy bypass where a legitimate JavaScript library from an allowlisted CDN would apply the victim's CSP nonce to injected scripts, allowing arbitrary code execution. This permitted unauthorized access to CSRF tokens, private profile data, and the ability to modify victim account information without authorization.

Critical
resolved

Launchpad file read leaks production keys

Bug reported by was disclosed at October 28, 2026, 4:53 am   |   Path Traversal

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.