# Domain pointing to vimeo portfolio are prone to takeover using on-demand.

Vimeo's on-demand custom-domain feature shared the same CNAME as portfolios but skipped cross-verification, letting an attacker claim a domain already pointed at Vimeo and take it over.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: bugdiscloseguys
- Disclosed: 2018-08-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/387307
- Library page: https://bugbountylibrary.com/r/h1%3A387307
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:chained vuln:subdomain-takeover

**Target:** Custom domain / CNAME claim feature (on-demand vs portfolio)
**Root cause:** On-demand custom-domain claiming did not cross-check whether the domain was already claimed by a portfolio; both features used the same CNAME (vimeopro.com), so ownership state was not shared between them.
**Steps:**
1. Pro user adds custom domain to a portfolio, creating a CNAME to `vimeopro.com`.
2. Attacker adds the same domain to an on-demand page; Vimeo does not verify it is already claimed by a portfolio.
3. Attacker's on-demand page now serves on the victim's domain, taking it over.
**How found:** Researcher noticed on-demand and portfolio custom-domain features required the same CNAME entry (`vimeopro.com`) and hypothesized no cross-verification existed between the two claim paths; Vimeo confirmed they only checked on-demand-to-on-demand, not on-demand-to-portfolio.
**Exploitation:** Attacker claims a domain already pointed at Vimeo via a portfolio by adding it to an on-demand page, gaining control of content served on that (sub)domain.
**Insight:** When two product features share the same DNS/CNAME verification target, test whether ownership claimed in one feature is honored by the other; parallel claim paths often skip cross-checks.