Improper Authorization

Every one of the 55 is a mark on the map. Named now: 1 to 26, most upvoted first.

1. Email address of any user can be queried on Report Invitation GraphQL type when username is known#792927HackerOne · 671 votesValid
2. [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deleted#757095Razer · $1,000 · 311 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
3. Shopify admin authentication bypass using partners.shopify.com#270981Shopify · 311 votesValid
4. Stealing Users OAuth authorization code via redirect_uri#1861974pixiv · $2,000 · 253 votesValid
5. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form#418767HackerOne · $10,000 · 208 votesValid
6. TikTok 2FA Bypass#1247108TikTok · $1,564 · 194 votesValid
7. Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"#2718253Insightly · 148 votesValid
8. Account takeover - improper validation of jwt signature (with regards to experiation date claim)#1760403Linktree · 147 votesValid
9. Using gossip to drain miner wallets#1058879Zilliqa · $10,000 · 111 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
10. Claiming the listing of a non-delivery restaurant through OTP manipulation#1330529Eternal · $3,250 · 108 votesValid
11. Unauthorized access to https://shipit.analogpond.com/#822547DigitalOcean · 86 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
12. [Razer Pay Android App] Multiple vulnerabilities chained to allow "RedPacket" money to be stolen by a 3rd party#753280Razer · $1,000 · 84 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
13. Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)#3371448Lovable VDP · 79 votesValid
14. TikTok's pixel/sdk.js leaks current URL from websites using postMessage#1598749TikTok · 79 votesValid
15. Improper authorization allows disclosing users' notification data in Notification channel server#1314162LY Corporation · $2,000 · 78 votesValid
16. Hijack all emails sent to any domain that uses Cloudflare Email Forwarding#1419341Cloudflare Public Bug Bounty · $6,000 · 76 votesValid
17. 2FA doesn't work in "https://insider.razer.com"#701901Razer · $200 · 72 votesno longer publicHackerOne no longer shows this report to the public (checked 2026-11-14). Its title and metadata are kept here.
18. Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)#3371414Lovable VDP · 66 votesValid
19. Attacker can generate cancelled transctions in a user's transaction history using only Steam ID#1021776CS Money · $300 · 66 votesValid
20. Bypass SMS verification to delete TikTok account#964467TikTok · 64 votesValid
21. Low-privileged user can enable or disable Lovable AI for new projects in workspace#3369843Lovable VDP · 56 votesValid
22. Account Takeover via billing#394329Chaturbate · $8,000 · 56 votesValid
23. [www.stripo.email] There is no rate limit for contact-us endpoints#856305Stripo Inc · 47 votesValid
24. Forget password link not expiring after email change.#411337Chaturbate · 46 votesValid
25. H1514 Removed Staff members who had "Apps" permission can still modify flow app connections#416983Shopify · 44 votesValid
26. User with privilege to maintain External Programs can update certain churned HackerOne programs#411930HackerOne · $500 · 41 votesValid

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.