com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover Analysed #1343300 Valid Cross-site Scripting High 2022-09-23 – 21 Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce Analysed #3981292 Valid Cross-site Scripting High 2026-10-28 – 27 A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option Analysed #3999856 Valid Access Control High 2026-10-30 – 33 Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook Analysed #3979217 Valid Authentication High 2026-10-30 – 34 Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps. Analysed #1710541 Valid File and Path Handling High 2023-06-07 – 38 CSRF on launchpad.37signals.com OAuth2 authorization endpoint Analysed #850022 Valid Cross-Site Request Forgery High 2020-10-30 – 44 Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses #4035023 Valid Access Control High 2026-10-20 – 44 Remote Code Execution in Basecamp Windows Electron App Analysed #1016966 Valid Command and Code Injection High 2020-11-19 – 48 One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML #3943339 Valid Cross-site Scripting High 2026-10-02 – 49 launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API Analysed #3955956 Valid Authentication High 2026-10-30 – 49 Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket) Analysed #403602 Valid Input Validation and Logic High 2020-11-26 – 57 Possible DOM XSS on app.hey.com Analysed #1010132 Valid Cross-site Scripting High 2020-10-27 – 68 Stored XSS on trix editor version 2.1.1 Analysed #2521419 Valid Cross-site Scripting High 2024-11-04 $1,000 76 Two click Account Takeover Analysed #3079738 Valid Deserialization and Object Injection High 2025-11-11 – 77 DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeover Analysed #3608199 Valid Cross-site Scripting High 2026-04-14 – 82 Insecure Bundler configuration fetching internal Gems (okra) from Rubygems.org #1104874 Valid Command and Code Injection High 2021-08-10 $5,000 102 Able to steal bearer token from deep link Analysed #1372667 Valid Authentication High 2022-03-27 $6,337 110 Improper bot-authentication allows to impersonate any user when sending messages in a room Analysed #3329310 Valid Authentication High 2025-11-21 $2,000 128 a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service Analysed #1018037 Valid Denial of Service High 2020-11-10 $1,000 132 AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp Analysed #2107680 Valid Information Disclosure High 2023-09-21 $8,868 248