Skip to content
Sign in

Bug bounty program

BU

Bumble

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
50
Disclosed reports
36
Subdomains
1,285

Most upvoted reports36

All reports
Most upvoted reports of Bumble
ReportWeaknessDisclosedBountyVotes
Reflected XSSAnalysed#739601Cross-site Scripting2019-11-21$1,000317
Exfiltrating a victim's exact location (to within 5m)Analysed#1234406Information Disclosure2021-07-21–278
Bruteforce password recovery codeAnalysed#743545Misconfiguration and Insecure Design2020-01-18–258
Leak of authorization urls leads to account takeoverAnalysed#746186Misconfiguration and Insecure Design2020-05-08–109
Misconfigured oauth leads to Pre account takeover#1074047Input Validation and Logic2021-03-18–90
Bumble API exposes read status of chat messages#1080437Information Disclosure2021-03-13$60074
[CRITICAL] Full account takeover using CSRF#127703Cross-Site Request Forgery2016-04-12–63
The login of Hotor Not is Vulnerable to bruteforce.#744692Authentication2020-01-23–59
Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free.#1037430No weakness recorded2020-12-07–57
On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easilty#792295Misconfiguration and Insecure Design2020-11-25–49

Subdomains1,285

Root
Scope
Name suggests:Staging
First seen
Text fileClear filters8 names
Subdomains of Bumble
NameScopeFirst seen
beta.badoo.comstagingNot in the scope2026-11-14
stage.badoo.comstagingNot in the scope2026-11-14
preview.badoo.comstagingNot in the scope2026-11-14
staging.badoo.comstagingNot in the scope2026-11-14
stg.v2.badoocdn.comstagingNot in the scope2026-11-14
beta.hotornot.comstagingNot in the scope2026-11-14
stage.hotornot.comstagingNot in the scope2026-11-14
preview.hotornot.comstagingNot in the scope2026-11-14

10 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in