Bug bounty program · HackerOne
Most upvoted reports13
- #3452015ValidUnauthenticated GraphQL access by prepending __schema to private operationsEnjin · Authentication · 2025 · Medium · no account (title)$50076votes
- #2312217ValidRevocation API Token by Bypassing The XSRF TokenEnjin · Cross-Site Request Forgery · 2024–60votes
- #3589247ValidUnauthenticated File Upload to CDNEnjin · Access Control · 2026 · Medium · no account (title)–56votes
- #2312320ValidWeak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log InEnjin · Authentication · 2024–48votes
- #1623672DuplicateHost header injection leads to account takeoverEnjin · Injection and Smuggling · 2024 · High–47votes
- #2682392ValidRace Condition on Create API FunctionEnjin · Race Conditions · 2024 · None–45votes
- #998457ValidAuthentication token and CSRF token bypassEnjin · Access Control · 2022$30044votes
- #2327238ValidLack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and MutationEnjin · Access Control · 2024–41votes
- #1108291ValidRace condition via project team member invitation system.Enjin · Input Validation and Logic · 2022–35votes
- #2545994ValidCloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.comEnjin · Command and Code Injection · 2024 · Low–29votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.