Bug bounty program · HackerOne
Most upvoted reports14
- #3024673ValidSSRF in Autodesk Rendering leading to account takeoverAutodesk · Server-Side Request Forgery · 2025 · Critical–161votes
- #2974307ValidStored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/Autodesk · Cross-site Scripting · 2025 · High · a user account (title)–139votes
- #2971572ValidStored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.Autodesk · Cross-site Scripting · 2025 · Medium–127votes
- #3045455ValidReflected XSS Vulnerability in SVG File at area-resources-stg.autodesk.comAutodesk · Cross-site Scripting · 2025 · Medium–93votes
- #3035275ValidTwitter broken link hijacking in thewild.comAutodesk · Access Control · 2025 · Low–87votes
- #2965143ValidDjango Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.comAutodesk · Information Disclosure · 2025 · Medium–82votes
- #2968039ValidInsecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages MutationAutodesk · Insecure Direct Object Reference · 2025 · High–80votes
- #2978923ValidHTML Injection in Business Name Parameter in PayappsAutodesk · Command and Code Injection · 2025 · Medium–75votes
- #2965357ValidInsecure Direct Object Reference (IDOR) Vulnerability in Autodesk User ProfileAutodesk · Insecure Direct Object Reference · 2025 · Medium–73votes
- #3008066ValidStored XSS in AREA tutorialsAutodesk · Cross-site Scripting · 2025 · High–73votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.