Reddit · disclosed reports
Access Control
13 disclosed reports · $13,000 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Reddit on HackerOne- reports
- 13
- paid a bounty
- 3
Every one of the 13 is a mark on the map. Named now: 1 to 13, most upvoted first.
- One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com
- Exposed proxy allows to access internal reddit domains
- Able to bypass email verification and change email to any other user email
- Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.
- Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API
- Oauth Misconfiguration Lead To Account Takeover
- [dubmash] Lack of authorization checks - Update Sound Titles
- Domain Takeover of Reddit.ru via DNS Hijacking
- api keys leaked
- oauth misconfigration lead to account takeover
- Huge amount of Subdomains Takeovers at Reddit.com
- Broken Authendication And Session Management
- S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.