Coinbase · disclosed reports
Misconfiguration and Insecure Design
17 disclosed reports · $1,700 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Coinbase on HackerOne- reports
- 17
- paid a bounty
- 4
Every one of the 17 is a mark on the map. Named now: 1 to 17, most upvoted first.
- Captcha Bypass in Coinbase SignUp Form
- Prepopulation of email address and name leaks information provided to other merchants
- Email leak in transcations in Android app
- ByPassing the email Validation Email on Sign up process in mobile apps
- Content Injection error page
- window.opener is leaking to external domains upon redirect on Safari
- Create Multiple Account Using Similar X-CSRF token
- 2FA settings allowed to be changed with no delay/freeze on funds
- User Enumeration, Information Disclosure and Lack of Rate Limitation on API
- Sandboxed iframes don't show confirmation screen
- Multiple Issues related to registering applications
- User's legal name could be changed despite front end controls being disabled
- 2 factor authentication design flaw
- X-Frame-Options
- SPF records not found
- Runtime manipulation iOS app breaking the PIN
- iframes considered harmful
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.