← Back to Security Research Portal (ccsimplyspolit.github.io)

H1-4148578: Coordinated Vulnerability Disclosure Verification Record (brave/ai-gateway)

[CLOSED AS INFORMATIVE / $50.00 USD BOUNTY AWARDED]
Privately reported to Brave Software (brave/ai-gateway) via HackerOne Report #4148578 covering Streaming Tool-Call Alignment Check Bypass on Multi-Tool Turns and Attachment-First User Message Extraction Failure in OpenAIAdapter.
Closed as Informative by Brave Software on 2026-10-27 and awarded a $50.00 USD bounty. Brave stated the user-message issue is minor and the tool-call parsing issue had already been reported internally. In compliance with Coordinated Vulnerability Disclosure (CVD) policy, exploit payloads remain withheld until the upstream patch is merged.

0x00 // Cryptographic Commitment & Verification Metadata

{
  "report_id": "4148578",
  "program": "brave (Brave Software Bug Bounty Program)",
  "repository": "brave/ai-gateway",
  "title": "Streaming Tool-Call Alignment Check Bypass on Multi-Tool Turns and Attachment-First User Message Extraction Failure in OpenAIAdapter",
  "reporter": "sshunko (Serhii Shunko)",
  "status": "Closed as Informative / $50.00 USD Bounty Awarded",
  "bounty_awarded_at": "2026-10-27T02:02:21Z",
  "severity": "medium",
  "cwe_ids": [
    "CWE-20",
    "CWE-755"
  ],
  "embargo_policy": "REDACTED_UNTIL_UPSTREAM_FIX_RELEASE",
  "specification_sha256_commitment": "db9d99c371f843aea681755479c69d66100f42137c6a50aba48960baadffc663"
}