HackerOne · disclosed reports
Input Validation and Logic
20 disclosed reports · $5,000 paid · 20 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 20
- valid
- 20
- paid a bounty
- 6
Every one of the 20 is a mark on the map. Named now: 1 to 20, most upvoted first.
- Hackerone is not properly deleting user id
- Getting New Invitations without Leaving Programs
- adding h1_analyst_* to username for normal users
- Any user could upload attachments to pentest scoping form they don't have access to
- Account recovery text message is sending a wrong domain to users.
- @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.
- Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature
- Asset Inventory Internal Descriptions are leaked in CSV export
- Minor security issue with Hackerone Invitations from sandbox program
- Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding
- Program managers can see draft reports using Export Reports feature
- Response program can display "eligible for bounty" in scope area in program policy
- Response program can create bounty table
- API Last Request Date/Time Not Updating
- Ability to invite a new member on Sandbox Program
- User's who are banned from program can still be invited to the new reports as collaborators
- [Bypass] Ability to invite a new member in sandbox Organization
- Lack warning label when receiving a letter
- A team member of the program with Report rights can ban the Admin
- Submitting report through Embedded Submission form gives user indefinite access to a profile
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.