X / xAI · disclosed reports
Input Validation and Logic
14 disclosed reports · $1,930 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open X / xAI on HackerOne- reports
- 14
- paid a bounty
- 3
Every one of the 14 is a mark on the map. Named now: 1 to 14, most upvoted first.
- Github Account hijack through broken link in developer.twitter.com
- Takeover of Twitter-owned domain at mobileapplinking.com
- Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.
- Ability to getting Twitter Blue verified badge without purchase it
- Subdomain takeover of images.crossinstall.com
- Bypassing x profile verification to receive instant blue checkmark and unlimited profile changes
- Opportunity to obtain private tweets through search widget preview caches
- Bypass t.co link shortener in Twitter direct messages
- Delete direct message history without access the proper conversation_id
- [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the user
- Twitter Source Label allow 'mongolian vowel separator' U+180E (app name)
- No Rate Limit in email leads to huge Mass mailings
- Global defaming of any twitter user
- Opportunity to post hidden comments
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.