While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products.
All those issues aren't security vulnerabilities per se, but they become one when combined. None of the issues is more critical than the others.
I would like that vulnerability to be fixed, so I plan to report it to vendors.
Following responsible disclosure guidelines, each report should not contain information about the other vendors' issues, but I'm afraid that all vendors will reject the report, explaining that their issue is the expected behavior.
Each vendor has a security program and a competent security team. The only problem is communicating the issues' impact to each of them.
What would be the best way to handle this problem?