X / xAI · disclosed reports
Authentication
35 disclosed reports · $3,080 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open X / xAI on HackerOne- reports
- 35
- paid a bounty
- 5
Every one of the 35 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Bypassing Digits origin validation which leads to account takeover
- Bypass Password Authentication for updating email and phone number - Security Vulnerability
- Insufficient OAuth callback validation which leads to Periscope account takeover
- Insufficient validation on Digits bridge
- Incorrect param parsing in Digits web authentication
- Bypassing Digits web authentication's host validation with HPP
- Attacker can get vine repost user all informations even Ip address and location .
- Bypassing Digits bridge origin validation
- [Studio.twitter.com] See someone else pics
- Bypass Password Authentication to Update the Password
- Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}
- Bypass Password Authentication to Update the Password
- niche s3 buckets are readable/writeable/deleteable by authorized AWS users
- Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)
- Reset password without knowing current password
- [Critical] - Steal OAuth Tokens
- 暴力破解用户密码没有速率控制
- Vine - overwrite account associated with email via android application
- Improper session handling on web browsers
- IDOR- Activate Mopub on different organizations- steal api token- Fabric.io
- Insecure direct object reference - have access to deleted DM's
- Problem with OAuth
- Flaw in login with twitter to steal Oauth tokens
- Urgent : Disclosure of all the apps with hash ID in mopub through API request (Authentication bypass)
- Twitter Ads Campaign information disclosure through admin without any authentication.
- Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.