Slack · disclosed reports
Authentication
16 disclosed reports · $12,600 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Slack on HackerOne- reports
- 16
- paid a bounty
- 7
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links
- Many Slack teams can be joined by abusing an improperly configured support@ inbox
- Unauthorized access to GovSlack
- Eavesdropping on private Slack calls
- Access to some Slack workspace metadata and settings available to unauthorized parties
- Bypass two-factor authentication
- Snooping into messages via email service
- Rate-limit bypass
- Source code leakage through GIT web access at host '52.91.137.42'
- Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authentication
- Authentication bypass leads to sensitive data exposure (token+secret)
- Slack OAuth2 "redirect_uri" Bypass
- Data exports stored on S3 can be scraped easily
- Generate new Test token
- Unauthenticated Access to some old file thumbnails
- Deleting Teams implemenation
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.