8x8 · Report #3837634
JaaS SIP Gateway Authorization Bypass
Validstatus
mediumseverity
$500bounty
64upvotes
12 Aug 2026disclosed
Summary
The JaaS SIP gateway endpoint (/sip-jibri-gateway/jibris/invite) validated the sip-outbound-call feature flag from client-supplied JWTs without verifying the tenant's actual provisioned entitlements. This allowed tenants to place outbound SIP calls regardless of their subscription level. Our team promptly validated and addressed the report by implementing server-side entitlement checks to ensure proper authorization enforcement.
We thank @offseq for submitting this report to us.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.