HackerOne · disclosed reports
Open Redirect
21 disclosed reports · $2,000 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 21
- paid a bounty
- 4
Every one of the 21 is a mark on the map. Named now: 1 to 21, most upvoted first.
- Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io
- Open Redirection in index.php page
- New link opening method makes hackerone vulnerable to tabnabbing
- Websites opened from reports can change url of report page
- Domain spoofing in redirect page using RTLO
- Open redirect vulnerability in index.php
- Open Redirection in [https://www.hackerone.com/index.php]
- Attachment references in markdown don't warn before downloading
- Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session
- Tab nabbing in Hackerone inbox.
- Limited Open redirection using SSO-SAML
- Bypassing the External Link Warning
- Open redirect in "Language change".
- External links should use rel="noopener" or use the redirect service
- Redirect while opening links in new tabs
- Open redirect deceive in hackerone.com via another open redirect link.
- "learn more here", reward email - domain expired.
- Cross-domain AJAX request
- Open-redirect on hackerone.com
- Redirect FILTER bypass in report/comment
- Homograph Attack
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.