connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability Analysed #3800870 Valid Cryptography High 2026-07-22 $1,337 111 Stored xss at https://█.8x8.com/api/█/ID Analysed #2078490 Valid Cross-site Scripting High 2023-10-30 $1,337 108 connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites Analysed #1474536 Valid Access Control High 2023-02-15 – 105 Information Disclosure of metrics fax.wavecell.com/metrics Analysed #1365076 Valid Information Disclosure Low 2025-05-30 – 93 █.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services Analysed #3250315 Valid Information Disclosure Medium 2025-08-14 $500 88 jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing Analysed #3789570 Valid Input Validation and Logic Low 2026-07-02 $100 72 jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze` Analysed #3485343 Valid File and Path Handling Low 2026-07-02 $100 68 connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scan Analysed #1875484 Valid Server-Side Request Forgery Medium 2023-05-15 – 65 JaaS SIP Gateway Authorization Bypass Analysed #3837634 Valid Access Control Medium 2026-08-12 $500 64 Jitsi Desktop Client RCE By Interacting with Malicious URL Schemes on Windows Analysed #1692603 Valid Command and Code Injection High 2023-02-10 $777 51 connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling) Analysed #3861550 Valid Deserialization and Object Injection Critical 2026-09-01 $3,000 49 Unprotected Atlantis Server at https://152.70.█.█ Analysed #2223041 Valid Authentication Medium 2024-04-11 – 48 admin.8x8.vc: Member users with no permission can integrate email to connect calendar via GET /meet-external/spot-roomkeeper/v1/calendar/auth/init?.. Analysed #1486310 Valid Access Control High 2023-02-15 – 48 Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM) Analysed #1957430 Valid Authentication Low 2023-04-27 – 47 Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.php Analysed #2331473 Valid Open Redirect Low 2024-03-20 $100 46 F5 BIG-IP TMUI RCE - CVE-2020-5902 (██.packet8.net) Analysed #1519841 Valid Command and Code Injection Critical 2022-03-25 – 46 Reflected xss on 8x8.com subdomain Analysed #770513 Valid Cross-site Scripting Medium 2020-02-12 – 44 Blind Command Injection #1 Analysed #807961 Valid Command and Code Injection High 2020-06-22 – 42 wavecell.com: Broken Link Hijacking / Instagram Takeover @██ Analysed #1826892 Valid Server-Side Request Forgery Low 2023-01-27 – 41 Subdomain takeover of ███.wavecell.com Analysed #1181762 Valid Access Control High 2021-05-02 – 39 [jitsi-meet] Authentication Bypass when using JWT w/ public keys Analysed #1210502 Valid Authentication Medium 2021-11-20 – 37 connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs Analysed #3858504 Valid Access Control High 2026-09-02 $1,337 36 Remote Code Execution on ██.8x8.com via .NET VSTATE Deserialization Analysed #1391576 Valid Command and Code Injection Critical 2022-02-03 – 36 connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2 Analysed #1499114 Valid Information Disclosure High 2023-02-15 – 31 Open Redirect - Polycom Company Directory Analysed #1836339 Valid Open Redirect Low 2023-10-17 – 28 Default credentials lead to Spring Boot Admin dashboard access Analysed #1417635 Valid Information Disclosure Medium 2022-01-02 – 28 @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration) Analysed #3889473 Valid Cross-site Scripting Low 2026-08-25 – 25 jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpoints Analysed #1479894 Valid Access Control High 2023-02-15 – 25 CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine Analysed #1607940 Valid Information Disclosure Low 2022-07-18 – 24 connect.8x8.com: deactivated users remain access to /api/v1/users/UUID/roles Analysed #1473071 Valid Access Control High 2023-02-15 – 24 ████ api key exposed in github.com/███/███ Analysed #1454965 Valid Cryptography High 2022-02-22 – 23 Open TURN relay abuse is possible due to lack of peer access control (Critical) Analysed #843256 Valid Server-Side Request Forgery High 2020-06-08 $700 23 Exposed kubernetes dashboard Analysed #1418101 Valid No weakness recorded Medium 2021-12-09 – 22 Access to ██████████████ due to weak credentials Analysed #692116 Valid Authentication Medium 2020-01-08 – 22 Stored Cross Site Scripting. Analysed #413077 Valid Cross-site Scripting High 2020-07-21 – 20 LFI via Jolokia at https://█.█.█.█:1293 Analysed #1641661 Valid Information Disclosure Medium 2022-07-20 – 19 Admin Reseller Account Disclosure Analysed #879562 Valid Information Disclosure Critical 2020-12-15 – 19 Directory Listing at https://█.█.█.█ Analysed #1771051 Valid Information Disclosure Low 2022-11-18 – 18 Authentication Bypass & ApacheTomcat Misconfiguration in [██] Analysed #1364022 Valid Authentication Medium 2021-11-04 – 18 DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.com Analysed #1280167 Valid Access Control Medium 2021-07-30 – 18 Insecure OAuth redirection at [admin.8x8.vc] Analysed #770548 Valid Input Validation and Logic High 2020-04-10 – 18 Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution Analysed #2095061 Valid Command and Code Injection Medium 2024-08-26 – 17 Public Apache Tomcat /examples example directory Analysed #1622624 Valid Information Disclosure Medium 2022-07-18 – 17 Hardcoded credentials in Android App Analysed #412772 Valid Information Disclosure High 2020-06-22 – 17 Reflected xss on 8x8.vc Analysed #771110 Valid Cross-site Scripting Medium 2020-01-15 – 16 speedtest.8x8.com: Enabled Directory Listing Analysed #1825472 Valid Information Disclosure Low 2023-03-28 – 15 Open Redirect ███.8x8.com Analysed #1637571 Valid Open Redirect Low 2022-07-17 – 15 DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com Analysed #1089502 Valid Access Control High 2021-02-15 – 15 2FA Disable With Wrong Password - Response Tampering. #893085 Valid Input Validation and Logic High 2020-10-21 – 14 Directory Listing vulnerability on █.packet8.net/php/include/ #790846 Valid Information Disclosure Low 2022-09-28 – 14