“After 3 years of reporting, the company finally fixed the vulnerability silently and didn’t bother to inform. On 1st August 2023, I tested the vulnerability again and found it fixed. The report is still marked as triage as of 21 October 2023, and their bug bounty policy mentions rewards but no bounty or even HackerOne points were rewarded by the company.”
Harvest’s Outlook calendar callback forwarded users to whatever domain sat in the state parameter. Pair that with Microsoft’s implicit grant flow and the access token lands on the attacker’s site. Harvest promised a fix in two weeks in April 2022 and shipped it a year later without telling the reporter. The bounty policy advertises rewards. The researcher got three years of silence and zero points.