HackerOne · disclosed reports
Authentication
39 disclosed reports · $28,000 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 39
- paid a bounty
- 12
Every one of the 39 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Account takeover via leaked session cookie
- HackerOne Jira integration plugin Leaked JWT to unauthorized jira users
- Web Authentication Endpoint Credentials Brute-Force Vulnerability
- h1-202 leaderboard photo discloses local wifi password
- HackerOne Code sends live password-reset tokens to Segment in automatic page events
- Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery
- Takeover of hackerone.engineering via Medium
- Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session
- HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks
- User login page doesn't implement any form of rate limiting
- AWS S3 bucket writeable for authenticated aws users
- Broken Authentication and session management OWASP A2
- Improper Authentication - 2FA OTP Reusable
- 2FA Bypass via Leaked Cookies
- Session Not Expire / 2FA Bypass
- SAML Response Reuse on hackerone.com/users/saml/auth
- Improper session management
- Able to create basic user account via Google login on HackerOne Drupal CMS
- TOTP Authenticator implementation Accepts Expired Codes
- Account takeover
- Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)
- Unauthorized Team members viewing
- Session Hijacking attack (Different Scenario)
- Private program activity timeline information disclosure
- External programs revealing info
- Restrict any user from logging into his account.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.