Bug bounty program
CO
Coursera
Most upvoted reports6
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XSS StoredAnalysed#205626 | Cross-site Scripting | 2018-01-12 | – | 28 |
| No Password Verification on Changing Email Address Cause Account takeoverAnalysed#292673 | Misconfiguration and Insecure Design | 2018-05-19 | – | 21 |
| Broken authentication and session management flawAnalysed#152080 | Authentication | 2016-08-18 | – | 15 |
| [www.coursera.org] Leaking password reset link on referrer header#303322 | Misconfiguration and Insecure Design | 2018-02-14 | – | 9 |
| XSS in https://www.coursera.org/courses/#127163 | Cross-site Scripting | 2016-09-14 | – | 5 |
| Stored XSS via transloadit.com and imageproxy#216822 | Cross-site Scripting | 2017-11-30 | – | 5 |
Subdomains309
| Name | Scope | First seen |
|---|---|---|
| rvbmbdxsdmiv.labs.coursera.org | Not in the scope | 2026-11-14 |
| rvoiyzcvomvg.labs.coursera.org | Not in the scope | 2026-11-14 |
| sharedsuptgvbc.labs.coursera.org | Not in the scope | 2026-11-14 |
| siqaryubizdf.labs.coursera.org | Not in the scope | 2026-11-14 |
| sjmkbsvrvagu.labs.coursera.org | Not in the scope | 2026-11-14 |
| srbeceylbdty.labs.coursera.org | Not in the scope | 2026-11-14 |
| tmhrpucnasnu.labs.coursera.org | Not in the scope | 2026-11-14 |
| tmqqytnsvfrl.labs.coursera.org | Not in the scope | 2026-11-14 |
| tvqvepjlqask.labs.coursera.org | Not in the scope | 2026-11-14 |
| txporthvtkei.labs.coursera.org | Not in the scope | 2026-11-14 |
| utgjgvnonfwc.labs.coursera.org | Not in the scope | 2026-11-14 |
| vabjkhporhgn.labs.coursera.org | Not in the scope | 2026-11-14 |
| vazdgemqyegi.labs.coursera.org | Not in the scope | 2026-11-14 |
| vqndfyjnwbek.labs.coursera.org | Not in the scope | 2026-11-14 |
| wildcard.labs.coursera.org | Not in the scope | 2026-11-14 |
| xsbcheocwsyk.labs.coursera.org | Not in the scope | 2026-11-14 |
| yrweiipqfooe.labs.coursera.org | Not in the scope | 2026-11-14 |
| zdovjhow.labs.coursera.org | Not in the scope | 2026-11-14 |
| ziwnprhmllde.labs.coursera.org | Not in the scope | 2026-11-14 |
| zlmltpzvoton.labs.coursera.org | Not in the scope | 2026-11-14 |
| zozwmpdsdhah.labs.coursera.org | Not in the scope | 2026-11-14 |
| zppcunlsuzgn.labs.coursera.org | Not in the scope | 2026-11-14 |
| zuzjnuwamman.labs.coursera.org | Not in the scope | 2026-11-14 |
| jqzuffu5.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| jytzxxwe.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| qiegkhf6.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| r0nq2pcw.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| rw1u8efs.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| uirtfggv.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| vy8stkzx.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| x69sbhgp.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| y7046dzs.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| z78nhkgr.m.learn.coursera.org | Not in the scope | 2026-11-14 |
| legal.coursera.org | Not in the scope | 2026-11-14 |
| link.coursera.org | Not in the scope | 2026-11-14 |
| mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| click.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| inbound.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1a1.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1a2.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1a3.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1a4.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1b1.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1b2.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1b3.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mta1b4.mail.coursera.orgmail | Not in the scope | 2026-11-14 |
| mcmaster.coursera.org | Not in the scope | 2026-11-14 |
| mosaic.coursera.org | Not in the scope | 2026-11-14 |
| mv-vpn.coursera.orgvpn | Not in the scope | 2026-11-14 |
| www.mv-vpn.coursera.orgvpn | Not in the scope | 2026-11-14 |
| mx.coursera.orgmail | Not in the scope | 2026-11-14 |
| pages.coursera.org | Not in the scope | 2026-11-14 |
| partnerinstructor.coursera.org | Not in the scope | 2026-11-14 |
| partnerships.coursera.org | Not in the scope | 2026-11-14 |
| pkumooc.coursera.org | Not in the scope | 2026-11-14 |
| princeton.coursera.org | Not in the scope | 2026-11-14 |
| projects.coursera.org | Not in the scope | 2026-11-14 |
| ps.coursera.org | Not in the scope | 2026-11-14 |
| pt.coursera.org | Not in the scope | 2026-11-14 |
| refugees.coursera.org | Not in the scope | 2026-11-14 |
| rice.coursera.org | Not in the scope | 2026-11-14 |
| rodp.coursera.org | Not in the scope | 2026-11-14 |
| rt.coursera.org | Not in the scope | 2026-11-14 |
| ru.coursera.org | Not in the scope | 2026-11-14 |
| s.coursera.org | Not in the scope | 2026-11-14 |
| services.coursera.org | Not in the scope | 2026-11-14 |
| share.coursera.org | Not in the scope | 2026-11-14 |
| shibboleth.coursera.org | Not in the scope | 2026-11-14 |
| skillsfuture.coursera.org | Not in the scope | 2026-11-14 |
| staging-proto.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging1-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging2-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging3-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging4-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging5-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| staging6-projects.coursera.orgstaging | Not in the scope | 2026-11-14 |
| stanford.coursera.org | Not in the scope | 2026-11-14 |
| status.coursera.orgmonitoring | Not in the scope | 2026-11-14 |
| store.coursera.org | Not in the scope | 2026-11-14 |
| support.coursera.org | Not in the scope | 2026-11-14 |
| teach.coursera.org | Not in the scope | 2026-11-14 |
| tech.coursera.org | Not in the scope | 2026-11-14 |
| testblog.coursera.org | Not in the scope | 2026-11-14 |
| testlaunch.coursera.org | Not in the scope | 2026-11-14 |
| testlaunch1.coursera.org | Not in the scope | 2026-11-14 |
| tools.coursera.org | Not in the scope | 2026-11-14 |
| tr.coursera.org | Not in the scope | 2026-11-14 |
| tw.coursera.org | Not in the scope | 2026-11-14 |
| u003ewww.coursera.org | Not in the scope | 2026-11-14 |
| ualberta.coursera.org | Not in the scope | 2026-11-14 |
| ubc.coursera.org | Not in the scope | 2026-11-14 |
| ucsd.coursera.org | Not in the scope | 2026-11-14 |
| umich.coursera.org | Not in the scope | 2026-11-14 |
| university-looker.coursera.org | Not in the scope | 2026-11-14 |
| unsw.coursera.org | Not in the scope | 2026-11-14 |
| utm.coursera.org | Not in the scope | 2026-11-14 |
| utoronto.coursera.org | Not in the scope | 2026-11-14 |
| vanderbilt.coursera.org | Not in the scope | 2026-11-14 |
| vote.coursera.org | Not in the scope | 2026-11-14 |
| ww.coursera.org | Not in the scope | 2026-11-14 |
1 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.