HackerOne · disclosed reports
Input Validation and Logic
31 disclosed reports · $6,500 paid · 31 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 31
- valid
- 31
- paid a bounty
- 8
Every one of the 31 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Hackerone is not properly deleting user id
- Getting New Invitations without Leaving Programs
- adding h1_analyst_* to username for normal users
- Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com
- Bypassing HackerOne 2FA due to race condition
- Any user could upload attachments to pentest scoping form they don't have access to
- Account recovery text message is sending a wrong domain to users.
- @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.
- Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature
- Improper UUID validation results in bypass of #419896
- Asset Inventory Internal Descriptions are leaked in CSV export
- Residual Malicious Payloads on HackerOne after Vulnerability Fixes
- Minor security issue with Hackerone Invitations from sandbox program
- Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding
- Program managers can see draft reports using Export Reports feature
- Response program can display "eligible for bounty" in scope area in program policy
- Response program can create bounty table
- Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification
- API Last Request Date/Time Not Updating
- Ability to invite a new member on Sandbox Program
- User's who are banned from program can still be invited to the new reports as collaborators
- Changing Victim's JIRA Integration Settings Through Multiple Bugs
- [Bypass] Ability to invite a new member in sandbox Organization
- Lack warning label when receiving a letter
- A team member of the program with Report rights can ban the Admin
- Dangling cloud instance at vpn.inverselink.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.