Reddit · disclosed reports
Input Validation and Logic
8 disclosed reports · $5,600 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Reddit on HackerOne- reports
- 8
- paid a bounty
- 3
Every one of the 8 is a mark on the map. Named now: 1 to 8, most upvoted first.
- Able to approve admin approval and change effective status without adding payment details .
- s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh
- IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter
- Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`
- Email Verification Bypass And Get access to user's private invitation.
- com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)
- Content Spoofing/Text Injection at https://gateway-production.dubsmash.com
- Content Spoofing
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.