Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Account Takeover via Password Reset without user interactions | No account | Another user's | The password-reset flow sent another user's reset link to an attacker-controlled address. |
| Exfiltrate and mutate repository and project data through injected templated service | A user account | Another tenant's | A regular user imported administrator-only templates that were then installed in projects created by other users. |
| Getting all the CD keys of any game | A user account | Another user's | A partner user retrieved another game's CD keys despite lacking access to that game. |
| Ability to reset password for account | No account | Another user's | The password-reset feature sent reset links to addresses selected by the requester. |
| Publicly accessible Continuous Integration Tool | No account | No object involved | A public user accessed an internal CI instance and its sensitive data. |
| One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com | No account | Another user's | A victim’s OAuth credentials were exposed to an attacker-controlled page through cross-window access. |
| Reset password link sent over unsecured http protocol | No account | The attacker's own | A network observer could obtain the reset token from the account owner's HTTP request. |
| Full account takeover | No account | Another user's | The login flow allegedly accepts a token issued to another application to authenticate as a different user. |
| Attacker is able to access commit title and team member comments which are supposed to be private | A user account | Another user's | A non-team member received email notifications containing activity from a team-only project. |
| Private list members disclosure via GraphQL | A user account | Another user's | A caller accessed another user's private-list membership through GraphQL after discovering its identifier. |
| Exposed proxy allows to access internal reddit domains | No account | No object involved | An unauthenticated external request was reportedly proxied to an internal domain. |
| [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start | A user account | Another user's | An attacker’s password-reset flow was reportedly able to change another user’s account password using that user’s reset data. |