Bug bounty program
CO
Coursera
Most upvoted reports6
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XSS StoredAnalysed#205626 | Cross-site Scripting | 2018-01-12 | – | 28 |
| No Password Verification on Changing Email Address Cause Account takeoverAnalysed#292673 | Misconfiguration and Insecure Design | 2018-05-19 | – | 21 |
| Broken authentication and session management flaw#152080 | Authentication | 2016-08-18 | – | 15 |
| [www.coursera.org] Leaking password reset link on referrer header#303322 | Misconfiguration and Insecure Design | 2018-02-14 | – | 9 |
| XSS in https://www.coursera.org/courses/#127163 | Cross-site Scripting | 2016-09-14 | – | 5 |
| Stored XSS via transloadit.com and imageproxy#216822 | Cross-site Scripting | 2017-11-30 | – | 5 |
Subdomains309
| Name | Scope | First seen |
|---|---|---|
| 38cc4-www.coursera.org | Not in the scope | 2026-11-14 |
| 66492-www.coursera.org | Not in the scope | 2026-11-14 |
| about.coursera.org | Not in the scope | 2026-11-14 |
| accounts.coursera.org | Not in the scope | 2026-11-14 |
| admin.coursera.orgadmin | Not in the scope | 2026-11-14 |
| android.coursera.org | Not in the scope | 2026-11-14 |
| api.coursera.orgapi | Not in the scope | 2026-11-14 |
| services.api.coursera.orgapi | Not in the scope | 2026-11-14 |
| api2.coursera.orgapi | Not in the scope | 2026-11-14 |
| apply.coursera.org | Not in the scope | 2026-11-14 |
| ar.coursera.org | Not in the scope | 2026-11-14 |
| ar-eg.coursera.org | Not in the scope | 2026-11-14 |
| assessments.coursera.org | Not in the scope | 2026-11-14 |
| authentication.coursera.org | Not in the scope | 2026-11-14 |
| berkeley.coursera.org | Not in the scope | 2026-11-14 |
| beta-test.coursera.orgstaging, test | Not in the scope | 2026-11-14 |
| blog.coursera.org | Not in the scope | 2026-11-14 |
| build.coursera.orgci | Not in the scope | 2026-11-14 |
| building.coursera.org | Not in the scope | 2026-11-14 |
| business.coursera.org | Not in the scope | 2026-11-14 |
| businesstest.coursera.org | Not in the scope | 2026-11-14 |
| ca.coursera.org | Not in the scope | 2026-11-14 |
| careers.coursera.org | Not in the scope | 2026-11-14 |
| quantil.cdn.coursera.org | Not in the scope | 2026-11-14 |
| class.coursera.org | Not in the scope | 2026-11-14 |
| cn.coursera.org | Not in the scope | 2026-11-14 |
| college.coursera.org | Not in the scope | 2026-11-14 |
| conference.coursera.org | Not in the scope | 2026-11-14 |
| conference2016.coursera.org | Not in the scope | 2026-11-14 |
| conference2017.coursera.org | Not in the scope | 2026-11-14 |
| conference2018.coursera.org | Not in the scope | 2026-11-14 |
| conference2019.coursera.org | Not in the scope | 2026-11-14 |
| corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| app50.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| aws2-avx-scep-dev.corp.coursera.orgdev, internal | Not in the scope | 2026-11-14 |
| aws2-avx-scep-prod.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| clearpass.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| www.clearpass.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| logui.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| op-datasets-ecs.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| op-it-tools.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| op-onepassword-connect.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| op-scim-bridge.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| op1-scim-bridge.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| s3antivirus.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| servicedesk.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| servicedesk-dev.corp.coursera.orgdev, internal | Not in the scope | 2026-11-14 |
| servicedesk-sb.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| servicedesk-test.corp.coursera.orginternal, test | Not in the scope | 2026-11-14 |
| vcenter.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| www.vcenter.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| vpn.corp.coursera.orginternal, vpn | Not in the scope | 2026-11-14 |
| www.vpn.corp.coursera.orginternal, vpn | Not in the scope | 2026-11-14 |
| zentral.corp.coursera.orginternal | Not in the scope | 2026-11-14 |
| de.coursera.org | Not in the scope | 2026-11-14 |
| demo-projects.coursera.orgtest | Not in the scope | 2026-11-14 |
| discover.coursera.org | Not in the scope | 2026-11-14 |
| dtu.coursera.org | Not in the scope | 2026-11-14 |
| duke.coursera.org | Not in the scope | 2026-11-14 |
| email.coursera.org | Not in the scope | 2026-11-14 |
| email-sg.coursera.org | Not in the scope | 2026-11-14 |
| o1.email-sg.coursera.org | Not in the scope | 2026-11-14 |
| click.email.coursera.org | Not in the scope | 2026-11-14 |
| cloud.email.coursera.org | Not in the scope | 2026-11-14 |
| image.email.coursera.org | Not in the scope | 2026-11-14 |
| mta.email.coursera.org | Not in the scope | 2026-11-14 |
| mta10.email.coursera.org | Not in the scope | 2026-11-14 |
| mta11.email.coursera.org | Not in the scope | 2026-11-14 |
| mta12.email.coursera.org | Not in the scope | 2026-11-14 |
| mta13.email.coursera.org | Not in the scope | 2026-11-14 |
| mta14.email.coursera.org | Not in the scope | 2026-11-14 |
| mta15.email.coursera.org | Not in the scope | 2026-11-14 |
| mta16.email.coursera.org | Not in the scope | 2026-11-14 |
| mta17.email.coursera.org | Not in the scope | 2026-11-14 |
| mta18.email.coursera.org | Not in the scope | 2026-11-14 |
| mta19.email.coursera.org | Not in the scope | 2026-11-14 |
| mta2.email.coursera.org | Not in the scope | 2026-11-14 |
| mta20.email.coursera.org | Not in the scope | 2026-11-14 |
| mta3.email.coursera.org | Not in the scope | 2026-11-14 |
| mta4.email.coursera.org | Not in the scope | 2026-11-14 |
| mta5.email.coursera.org | Not in the scope | 2026-11-14 |
| mta6.email.coursera.org | Not in the scope | 2026-11-14 |
| mta7.email.coursera.org | Not in the scope | 2026-11-14 |
| mta8.email.coursera.org | Not in the scope | 2026-11-14 |
| mta9.email.coursera.org | Not in the scope | 2026-11-14 |
| view.email.coursera.org | Not in the scope | 2026-11-14 |
| en.coursera.org | Not in the scope | 2026-11-14 |
| enterprise.coursera.org | Not in the scope | 2026-11-14 |
| enterprise-looker-v2.coursera.org | Not in the scope | 2026-11-14 |
| epfl.coursera.org | Not in the scope | 2026-11-14 |
| es.coursera.org | Not in the scope | 2026-11-14 |
| eventing.coursera.org | Not in the scope | 2026-11-14 |
| experts.coursera.org | Not in the scope | 2026-11-14 |
| fr.coursera.org | Not in the scope | 2026-11-14 |
| gsnlink.gainsight.coursera.orgNew | Not in the scope | 2026-11-15 |
| gatech.coursera.org | Not in the scope | 2026-11-14 |
| gb.coursera.org | Not in the scope | 2026-11-14 |
| go.coursera.org | Not in the scope | 2026-11-14 |
| gp.coursera.org | Not in the scope | 2026-11-14 |
| production-common-skillspace.gp.coursera.org | Not in the scope | 2026-11-14 |
1 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.