Bug bounty program · HackerOne
Khan Academy
Most upvoted reports71
- #442901ValidTake over of accounts created using Google or FacebookKhan Academy · Cross-Site Request Forgery · 2019–184votes
- #3723458Valid1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationKhan Academy · Access Control · 2026 · Critical–126votes
- #419891ValidCross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversKhan Academy · Cross-Site Request Forgery · 2019–111votes
- #3080597ValidUnauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Khan Academy · Cryptography · 2025 · Critical–107votes
- #3099978ValidLeaked reused password for a few Khan Academy usersKhan Academy · Cryptography · 2025 · High–92votes
- #3250691Valid337k users and 1 employee leaked credentialsKhan Academy · Information Disclosure · 2025 · High–87votes
- #2846011ValidXSS on using the legacy "Graphie To Png" APIKhan Academy · Cross-site Scripting · 2025 · Critical–86votes
- #2234420ValidText Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Khan Academy · Misconfiguration and Insecure Design · 2023–83votes
- #538800ValidAccount takeover by changing emailKhan Academy · Cross-Site Request Forgery · 2019–80votes
- #1210043ValidEnumerate all the class codes via google dorkingKhan Academy · Access Control · 2021–44votes
Subdomains382
0 covered by the program's own scope · 0 first seen this week
Roots:khanacademy.org 382
Name suggestsAnything
382 names
| Name | Scope | First seen |
|---|---|---|
| _mta-sts.khanacademy.org | No domain scope published | 2026-11-14 |
| a.khanacademy.org | No domain scope published | 2026-11-14 |
| admin.khanacademy.orgadmin | No domain scope published | 2026-11-14 |
| alerta.khanacademy.org | No domain scope published | 2026-11-14 |
| analytics.khanacademy.org | No domain scope published | 2026-11-14 |
| analytics-dashboards.khanacademy.org | No domain scope published | 2026-11-14 |
| annualreport.khanacademy.org | No domain scope published | 2026-11-14 |
| 2023-2024.annualreport.khanacademy.org | No domain scope published | 2026-11-14 |
| www.annualreport.khanacademy.org | No domain scope published | 2026-11-14 |
| api.khanacademy.orgapi | No domain scope published | 2026-11-14 |
| api-explorer.khanacademy.orgapi | No domain scope published | 2026-11-14 |
| www.api-explorer.khanacademy.orgapi | No domain scope published | 2026-11-14 |
| app.khanacademy.org | No domain scope published | 2026-11-14 |
| ar.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.ar.khanacademy.org | No domain scope published | 2026-11-14 |
| as.khanacademy.org | No domain scope published | 2026-11-14 |
| autoconfig.khanacademy.org | No domain scope published | 2026-11-14 |
| automator.khanacademy.org | No domain scope published | 2026-11-14 |
| www.automator.khanacademy.org | No domain scope published | 2026-11-14 |
| aws-jenkins.khanacademy.orgci | No domain scope published | 2026-11-14 |
| az.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.az.khanacademy.org | No domain scope published | 2026-11-14 |
| b.khanacademy.org | No domain scope published | 2026-11-14 |
| bbs.khanacademy.org | No domain scope published | 2026-11-14 |
| beta.khanacademy.orgstaging | No domain scope published | 2026-11-14 |
| bg.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.bg.khanacademy.org | No domain scope published | 2026-11-14 |
| blog.khanacademy.org | No domain scope published | 2026-11-14 |
| bn.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.bn.khanacademy.org | No domain scope published | 2026-11-14 |
| boxes.khanacademy.org | No domain scope published | 2026-11-14 |
| brand.khanacademy.org | No domain scope published | 2026-11-14 |
| builder.khanacademy.org | No domain scope published | 2026-11-14 |
| buildmaster.khanacademy.org | No domain scope published | 2026-11-14 |
| buildmaster-bottest.khanacademy.org | No domain scope published | 2026-11-14 |
| buildmasteralan.khanacademy.org | No domain scope published | 2026-11-14 |
| c.khanacademy.org | No domain scope published | 2026-11-14 |
| careers.khanacademy.org | No domain scope published | 2026-11-14 |
| cdn.khanacademy.org | No domain scope published | 2026-11-14 |
| checkout.khanacademy.org | No domain scope published | 2026-11-14 |
| citrix.khanacademy.orgvpn | No domain scope published | 2026-11-14 |
| cloud.khanacademy.org | No domain scope published | 2026-11-14 |
| cmn.khanacademy.org | No domain scope published | 2026-11-14 |
| cname.khanacademy.org | No domain scope published | 2026-11-14 |
| content.khanacademy.org | No domain scope published | 2026-11-14 |
| continueaprendendo.khanacademy.org | No domain scope published | 2026-11-14 |
| cpanel.khanacademy.orgadmin | No domain scope published | 2026-11-14 |
| crm.khanacademy.org | No domain scope published | 2026-11-14 |
| crowdin.khanacademy.org | No domain scope published | 2026-11-14 |
| crowdin-gcs-sync.khanacademy.org | No domain scope published | 2026-11-14 |
| crowdin-go.khanacademy.org | No domain scope published | 2026-11-14 |
| cs.khanacademy.org | No domain scope published | 2026-11-14 |
| cs-blog.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.cs.khanacademy.org | No domain scope published | 2026-11-14 |
| da.khanacademy.org | No domain scope published | 2026-11-14 |
| da-da.khanacademy.org | No domain scope published | 2026-11-14 |
| www.da-dk.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.da.khanacademy.org | No domain scope published | 2026-11-14 |
| www.da.khanacademy.org | No domain scope published | 2026-11-14 |
| dashboards.khanacademy.org | No domain scope published | 2026-11-14 |
| data.khanacademy.org | No domain scope published | 2026-11-14 |
| data-labeling.khanacademy.org | No domain scope published | 2026-11-14 |
| data-labeling-test.khanacademy.orgtest | No domain scope published | 2026-11-14 |
| de.khanacademy.org | No domain scope published | 2026-11-14 |
| de-de.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.de.khanacademy.org | No domain scope published | 2026-11-14 |
| dev.khanacademy.orgdev | No domain scope published | 2026-11-14 |
| devops.khanacademy.org | No domain scope published | 2026-11-14 |
| devops2.khanacademy.org | No domain scope published | 2026-11-14 |
| devopsalan.khanacademy.org | No domain scope published | 2026-11-14 |
| districtpartnerships.khanacademy.org | No domain scope published | 2026-11-14 |
| districts.khanacademy.org | No domain scope published | 2026-11-14 |
| dnm.khanacademy.org | No domain scope published | 2026-11-14 |
| dns.khanacademy.org | No domain scope published | 2026-11-14 |
| dns1.khanacademy.org | No domain scope published | 2026-11-14 |
| dns2.khanacademy.org | No domain scope published | 2026-11-14 |
| docker.khanacademy.orgtools | No domain scope published | 2026-11-14 |
| donate.khanacademy.org | No domain scope published | 2026-11-14 |
| dyn.khanacademy.org | No domain scope published | 2026-11-14 |
| click.e.khanacademy.org | No domain scope published | 2026-11-14 |
| cloud.e.khanacademy.org | No domain scope published | 2026-11-14 |
| image.e.khanacademy.org | No domain scope published | 2026-11-14 |
| mta.e.khanacademy.org | No domain scope published | 2026-11-14 |
| mta2.e.khanacademy.org | No domain scope published | 2026-11-14 |
| mta3.e.khanacademy.org | No domain scope published | 2026-11-14 |
| view.e.khanacademy.org | No domain scope published | 2026-11-14 |
| early.khanacademy.org | No domain scope published | 2026-11-14 |
| el.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.el.khanacademy.org | No domain scope published | 2026-11-14 |
| elastic.khanacademy.orgdata | No domain scope published | 2026-11-14 |
| email.khanacademy.org | No domain scope published | 2026-11-14 |
| emails.khanacademy.org | No domain scope published | 2026-11-14 |
| en.khanacademy.org | No domain scope published | 2026-11-14 |
| engineering.khanacademy.org | No domain scope published | 2026-11-14 |
| error-monitor-db.khanacademy.orgdata, monitoring | No domain scope published | 2026-11-14 |
| es.khanacademy.org | No domain scope published | 2026-11-14 |
| es-es.khanacademy.org | No domain scope published | 2026-11-14 |
| wildcard.es.khanacademy.org | No domain scope published | 2026-11-14 |
| www.es.khanacademy.org | No domain scope published | 2026-11-14 |
| exchange.khanacademy.orgmail | No domain scope published | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.