Vercel subdomain takeover — capitalcalc.settle.com & embed.settle.com

Disclosed by
jagdishpandey
  • Engagement Settle Vulnerability Disclosure Program
  • Disclosed date 17 days ago
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by Settle Vulnerability Disclosure Program

Retired marketing subdomains had dangling DNS records pointing at a deleted hosting deployment. The records were removed within a day of the report.

Summary by jagdishpandey

A high-severity subdomain takeover vulnerability (dangling DNS) was identified affecting subdomains . Both subdomains pointed via CNAME records to an inactive Vercel deployment that had been deleted or left unclaimed. 

An attacker could have claimed these orphaned projects on Vercel to host unauthorized content, provision valid TLS certificates under the target domain, and execute highly convincing credential phishing campaigns against users and employees. 

The organization's security team promptly validated the finding and successfully removed the dangling CNAME records to fully remediate the security risk.

Activity