Cloudflare Public Bug Bounty · disclosed reports
Authentication
8 disclosed reports · $1,850 paid · 7 valid · 1 informative
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Cloudflare Public Bug Bounty on HackerOne- reports
- 8
- valid
- 7
- paid a bounty
- 4
Every one of the 8 is a mark on the map. Named now: 1 to 8, most upvoted first.
- Bypass R2 payment screen
- Any WARP User Can Access Organization-Specific Application
- Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat
- Signup with any Email and Enable 2-FA without verifying Email
- Bypass two-factor authentication
- Sign in with Apple works on existing accounts, bypasses 2FA
- Bypassing creation of API tokens without email verification
- Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP