Uber · disclosed reports
Misconfiguration and Insecure Design
17 disclosed reports · $5,750 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Uber on HackerOne- reports
- 17
- paid a bounty
- 2
Every one of the 17 is a mark on the map. Named now: 1 to 17, most upvoted first.
- Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server
- Avoiding Surge Pricing
- Stealing users password (Limited Scenario)
- Possibility to brute force invite codes in riders.uber.com
- Bruteforce INVITE codes easy way
- Content injection on 404 error page at faspex.uber.com
- Email Address Enumeration
- Brute-Forcing invite codes in partners.uber.com
- Uber is Flooding my Mobile with SMS Daily like a cron JOB
- Text Only Content Spoofing on ubermovement.com Community Page
- Unsubscribe any user from receiving email
- It is possible to re-rate a driver after a very long time
- Active Email Hyperlink Sent on riders.uber.com
- Clickjacking in love.uber.com
- Changing Driver Passwords With Only an Authenticated Session (no password, no email)
- Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload Page
- Brute Force Amplification Attack
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.