Coinbase · disclosed reports
Authentication
15 disclosed reports · $2,900 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Coinbase on HackerOne- reports
- 15
- paid a bounty
- 6
Every one of the 15 is a mark on the map. Named now: 1 to 15, most upvoted first.
- Bypassing 2FA for BTC transfers
- OAuth authorization page vulnerable to clickjacking
- Transactions visible on Unconfirmed devices
- No authorization required in iOS device web-application
- coinbase Email leak while sending and requesting
- No authorization required in Windows phone web-application
- OAUTH pemission set as true= lead to authorize malicious application
- Two-factor authentication (via SMS)
- New Device confirmation tokens are not properly validated.
- An adversary can overwhelm the resources by automating Forgot password/Sign Up requests
- open authentication bug
- Simultaneous Session Logon : Improper Session Management
- Sending payments via QR code does not require confirmation
- Direct URL access to completed reports
- Information disclosure in coinbase android app
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.