Reddit · disclosed reports
Authentication
10 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Reddit on HackerOne- reports
- 10
- valid
- 0
- paid a bounty
- 0
Every one of the 10 is a mark on the map. Named now: 1 to 10, most upvoted first.
- Weak rate limit could lead to ATO due to weak password protection mechanisms
- Can use the Reddit android app as usual even though revoking the access of it from reddit.com
- [dubsmash] Username and password bruteforce
- Missing rate limit in current password change settings leads to Account takeover
- No rate limit leads to spaming post
- registering with the same email address multiple times leads to account takeover
- Rate limit is implemented in Reddit , but its not working .
- User Account has been taken out
- hardcoded api secret & api key in com.reddit.frontpage
- No Rate limit on change password leads to account takeover
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP