Domain pointing to vimeo portfolio are prone to takeover using on-demand.

Summary

We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio.

Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your (sub)Domain, However Vimeo offers same feature for on-demand pages which required same CNAME entry as portfolios, No cross verification was done if the domain is added in portfolio before or not and hence an attacker could have used on-demand page to takeover a (sub)Domain pointing to Vimeo regardless of its been already claimed.

In case you're wondering about CNAME entry, It is vimeopro.com, If not claimed you can takeover. Another vector for subdomain takeover, I found few!