HackerOne Disclosed Reports - 2026-07-27

Medium
resolved

Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

Bug reported by Nick Frichette (Datadog) was disclosed at July 27, 2026, 7:51 pm   |   Insufficient Logging

A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior were identified and described in the report.

Critical
resolved

Authentication Bypass via XML Signature Wrapping in SAML SSO

Bug reported by jayden was disclosed at July 27, 2026, 4:37 pm   |   Improper Authentication - Generic

The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.