Skip to content
BackEsc
Connect AISign inSign up free

Uber · disclosed reports

Authentication

40 disclosed reports · $53,350 paid · 24 valid · 12 informative · 4 duplicate

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Connect AI

Open Uber on HackerOne
reports
40
valid
24
paid a bounty
12

Every one of the 40 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. Chained Bugs to Leak Victim's Uber's FB Oauth Token#202781Uber · 427 votesValid
  2. Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)#143717Uber · 312 votesValid
  3. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com#219205Uber · 183 votesValid
  4. Open Redirect on central.uber.com allows for account takeover#206591Uber · 144 votesValid
  5. Reading Emails in Uber Subdomains#156536Uber · 141 votesValid
  6. password reset token leaking allowed for ATO of an Uber account#173551Uber · $10,000 · 100 votesValid
  7. [CRITICAL] -- Complete Account Takeover#136885Uber · $8,000 · 89 votesValid
  8. SAML Authentication Bypass on uchat.uberinternal.com#223014Uber · $8,500 · 88 votesValid
  9. OneLogin authentication bypass on WordPress sites#136169Uber · $10,000 · 58 votesValid
  10. Arbitrary File Reading on Uber SSL VPN#617543Uber · $6,500 · 38 votesValid

    CVE-2019-11508CVE-2019-11510CVE-2019-11538CVE-2019-11539CVE-2019-11540

  11. pam_ussh does not properly validate the SSH certificate authority#1177356Uber · 31 votesValid
  12. Get organization info base on uuid#151465Uber · $3,000 · 26 votesValid
  13. Possibility to enumerate and bruteforce promotion codes in Uber iOS App#125707Uber · $3,000 · 24 votesValid
  14. pam-ussh may be tricked into using another logged in user's ssh-agent#204802Uber · 23 votesValid
  15. Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP#439223Uber · $750 · 14 votesValid
  16. SMS/Call spamming due to truncated phone number#177551Uber · 14 votesValid
  17. No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts#281344Uber · 12 votesValid
  18. Physical Access to Mobile App Allows Local Attribute Updates without Authentication#165561Uber · 12 votesValid
  19. [IODR] Get business trip via organization id#151470Uber · $2,000 · 10 votesValid
  20. SMS URL verification link does not expire on phone number change and lacks rate limiting#200179Uber · 9 votesValid
  21. Can add employee in business.uber.com without add payment method#153175Uber · 8 votesInformative
  22. It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without#298862Uber · 7 votesInformative

    CVE-2005-0202CVE-2005-2169

  23. Users can falsely declare their own Uber account info on the monthly billing application#168453Uber · 7 votesValid
  24. Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication#298990Uber · 6 votesInformative

    CVE-2005-0202CVE-2005-2169

  25. The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting#293359Uber · 5 votesInformative
  26. Password Reset Does Not Confirm the Existence of an Email Address#143291Uber · 5 votesInformative

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated