Starbucks · disclosed reports
Cross-Site Request Forgery
11 disclosed reports · $0 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Starbucks on HackerOne- reports
- 11
- paid a bounty
- 0
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome
- Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xml
- Norway - store.starbucks.no - CSRF on email change
- Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sites
- CSRF: add item to victim's cart automatically (starbucks.com - updatecart)
- Missing CSRF Token On Remove Coupun From Cart
- CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard)
- CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card
- Missing CSRF Token On Add Coupon To Basket
- CSRF exploit | Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments)
- csrf blogs.starbucks.com
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.