Verified reproduction
GHSA-9WJX-4J4R-FF8W: Reported Horilla protected_media Referer authentication bypass
GHSA-9WJX-4J4R-FF8W is verified against horilla/horilla-hr · github vulnerability class: Auth Bypass This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00296.
Severity HIGH
Confidence HIGH
Reproduced in 77m 9s
Tool calls 276
Spend $16.04
$
pruva-verify REPRO-2026-00296 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00296/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
Pruva Ticket Brief: Horilla Referer Authorization Bypass
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_stderr.txt0.0 KBbundle/repro/reproduction_steps.sh26.6 KBbundle/repro/rca_report.md8.0 KBbundle/repro/runtime_manifest.json14.4 KBbundle/logs/reproduction_steps.log2.6 KBbundle/logs/reproduction_steps_20260722T055646Z-13223.log2.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/matrix_summary.json1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_source_identity.json1.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/protected_media_hunks.log2.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/prepare_runtime.log27.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/prepare_runtime.log27.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_result.json0.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_inspect.json10.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/modified_file_inventory_after_startup.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/private_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_setup.json0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_final.log0.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_startup.log0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_id.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_inspect.json10.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_body.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_headers.txt0.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_headers.txt0.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_trace.txt1.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_final.log0.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/modified_file_inventory_after_startup.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/private_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_setup.json0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_id.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_inspect.json10.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_body.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_startup.log0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_headers.txt0.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_trace.txt1.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_headers.txt0.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_trace.txt1.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/modified_file_inventory_after_startup.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_final.log0.8 KBbundle/repro/validation_verdict.json0.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_source_identity.json1.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_result.json0.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_result.json0.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_result.json0.3 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/private_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/cache_context_resolved.json0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_worktree_head.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_worktree_head.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_id.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_body.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_startup.log0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_headers.txt0.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_final.log0.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_setup.json0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_id.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_inspect.json10.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_body.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_startup.log0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_trace.txt1.8 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_headers.txt0.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_headers.txt0.5 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_headers.txt0.7 KBbundle/logs/pip_install_vuln_f86e9625862fa828_20260722T055646Z-13223.log0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/vuln_f86e9625862fa828_pip_freeze.txt2.1 KBbundle/logs/pip_install_fixed_7fb44184827cf327_20260722T055646Z-13223.log0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/fixed_7fb44184827cf327_pip_freeze.txt2.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/modified_file_inventory_after_prepare.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/modified_file_inventory_after_prepare.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_setup.json0.4 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_trace.txt1.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/modified_file_inventory_after_startup.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/private_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_canary.txt0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_headers.txt0.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_body.bin0.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_trace.txt1.6 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_headers.txt0.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_trace.txt1.7 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_stderr.txt0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_meta.json1.1 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_body.bin0.0 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_meta.json0.9 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_request.txt0.2 KBbundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_headers.txt0.7 KB