Rockstar Games · disclosed reports
Cross-Site Request Forgery
16 disclosed reports · $150 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Rockstar Games on HackerOne- reports
- 16
- paid a bounty
- 1
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- Account Takeover using Linked Accounts due to lack of CSRF protection
- SocialClub Account Take Over Through Import Friends feature
- Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.
- CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/
- Facebook OAuth Code Theft through referer leakage on support.rockstargames.com
- CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'
- <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->
- Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/article
- CSRF Vulnerability on post creation page /community/create-post.json
- CSRF Vulnerability allows attackers to steal SocialClub private token.
- SocialClub's Facebook OAuth Theft through Warehouse XSS.
- csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.json
- Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.html
- Found CSRF Vulnerability in https://support.rockstargames.com/
- Referer Leakge in language changer may lead to FB token theft.
- CSRF Vulnerabiliy on Facebook Linkage Page Allows Full Account takerover of Socialclub Accounts.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.