Rockstar Games · disclosed reports
Information Disclosure
20 disclosed reports · $1,800 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Rockstar Games on HackerOne- reports
- 20
- paid a bounty
- 5
Every one of the 20 is a mark on the map. Named now: 1 to 20, most upvoted first.
- Stealing Facebook OAuth Code Through Screenshot viewer
- full path disclosure on www.rockstargames.com via apache filename brute forcing
- Smuggle SocialClub's Facebook OAuth Code via Referer Leakage
- Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft.
- Exploiting Misconfigured CORS to Steal User Information
- Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication
- phpinfo() on graph.rockstargames.com exposes sensitive information
- Table and Column Exposure
- Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft.
- Source Code Disclosure (CGI)
- Full path Disclosure in Rockstargames.com██████████
- Leak IP internal
- Image Injection on `/bully/anniversaryedition` may lead to FB's OAuth Token Theft.
- Image Injection on /bully/anniversaryedition may lead to OAuth token theft.
- Image Injection vulnerability affecting www.rockstargames.com/careers may lead to Facebook OAuth Theft
- image injection /screenshot-viewer/responsive/image (ANOTHER FIX BYPASS)
- Image injection on /screenshot-viewer/responsive/image ( FIX BYPASS)
- Image injection /br/games/info may lead to phishing attacks or FB OAuth theft.
- Referer Referer Header Leakage in language changer may lead to FB token theft
- Image Injection Vulnerability on /bully/screens
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.