Skip to content
Connect AISign inSign up free

Bug bounty program

KA

Khan Academy

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
0
Disclosed reports
71
Subdomains
382

Most upvoted reports71

All reports
Most upvoted reports of Khan Academy
ReportWeaknessDisclosedBountyVotes
Take over of accounts created using Google or FacebookAnalysed#442901Cross-Site Request Forgery2019-05-17–184
1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationAnalysed#3723458Access Control2026-06-20–126
Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversAnalysed#419891Cross-Site Request Forgery2019-06-22–111
Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Analysed#3080597Cryptography2025-05-07–107
Leaked reused password for a few Khan Academy usersAnalysed#3099978Cryptography2025-07-12–92
337k users and 1 employee leaked credentialsAnalysed#3250691Information Disclosure2025-09-10–87
XSS on using the legacy "Graphie To Png" APIAnalysed#2846011Cross-site Scripting2025-02-06–86
Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Analysed#2234420Misconfiguration and Insecure Design2023-12-22–83
Account takeover by changing emailAnalysed#538800Cross-Site Request Forgery2019-05-17–80
Enumerate all the class codes via google dorkingAnalysed#1210043Access Control2021-07-22–44

Subdomains382

Root
Scope:No domain scope published
Name suggests
First seen
Text fileClear filters382 names
Subdomains of Khan Academy
NameScopeFirst seen
_mta-sts.khanacademy.orgNo domain scope published2026-11-14
a.khanacademy.orgNo domain scope published2026-11-14
admin.khanacademy.orgadminNo domain scope published2026-11-14
alerta.khanacademy.orgNo domain scope published2026-11-14
analytics.khanacademy.orgNo domain scope published2026-11-14
analytics-dashboards.khanacademy.orgNo domain scope published2026-11-14
annualreport.khanacademy.orgNo domain scope published2026-11-14
2023-2024.annualreport.khanacademy.orgNo domain scope published2026-11-14
www.annualreport.khanacademy.orgNo domain scope published2026-11-14
api.khanacademy.orgapiNo domain scope published2026-11-14
api-explorer.khanacademy.orgapiNo domain scope published2026-11-14
www.api-explorer.khanacademy.orgapiNo domain scope published2026-11-14
app.khanacademy.orgNo domain scope published2026-11-14
ar.khanacademy.orgNo domain scope published2026-11-14
wildcard.ar.khanacademy.orgNo domain scope published2026-11-14
as.khanacademy.orgNo domain scope published2026-11-14
autoconfig.khanacademy.orgNo domain scope published2026-11-14
automator.khanacademy.orgNo domain scope published2026-11-14
www.automator.khanacademy.orgNo domain scope published2026-11-14
aws-jenkins.khanacademy.orgciNo domain scope published2026-11-14
az.khanacademy.orgNo domain scope published2026-11-14
wildcard.az.khanacademy.orgNo domain scope published2026-11-14
b.khanacademy.orgNo domain scope published2026-11-14
bbs.khanacademy.orgNo domain scope published2026-11-14
beta.khanacademy.orgstagingNo domain scope published2026-11-14
bg.khanacademy.orgNo domain scope published2026-11-14
wildcard.bg.khanacademy.orgNo domain scope published2026-11-14
blog.khanacademy.orgNo domain scope published2026-11-14
bn.khanacademy.orgNo domain scope published2026-11-14
wildcard.bn.khanacademy.orgNo domain scope published2026-11-14
boxes.khanacademy.orgNo domain scope published2026-11-14
brand.khanacademy.orgNo domain scope published2026-11-14
builder.khanacademy.orgNo domain scope published2026-11-14
buildmaster.khanacademy.orgNo domain scope published2026-11-14
buildmaster-bottest.khanacademy.orgNo domain scope published2026-11-14
buildmasteralan.khanacademy.orgNo domain scope published2026-11-14
c.khanacademy.orgNo domain scope published2026-11-14
careers.khanacademy.orgNo domain scope published2026-11-14
cdn.khanacademy.orgNo domain scope published2026-11-14
checkout.khanacademy.orgNo domain scope published2026-11-14
citrix.khanacademy.orgvpnNo domain scope published2026-11-14
cloud.khanacademy.orgNo domain scope published2026-11-14
cmn.khanacademy.orgNo domain scope published2026-11-14
cname.khanacademy.orgNo domain scope published2026-11-14
content.khanacademy.orgNo domain scope published2026-11-14
continueaprendendo.khanacademy.orgNo domain scope published2026-11-14
cpanel.khanacademy.orgadminNo domain scope published2026-11-14
crm.khanacademy.orgNo domain scope published2026-11-14
crowdin.khanacademy.orgNo domain scope published2026-11-14
crowdin-gcs-sync.khanacademy.orgNo domain scope published2026-11-14
crowdin-go.khanacademy.orgNo domain scope published2026-11-14
cs.khanacademy.orgNo domain scope published2026-11-14
cs-blog.khanacademy.orgNo domain scope published2026-11-14
wildcard.cs.khanacademy.orgNo domain scope published2026-11-14
da.khanacademy.orgNo domain scope published2026-11-14
da-da.khanacademy.orgNo domain scope published2026-11-14
www.da-dk.khanacademy.orgNo domain scope published2026-11-14
wildcard.da.khanacademy.orgNo domain scope published2026-11-14
www.da.khanacademy.orgNo domain scope published2026-11-14
dashboards.khanacademy.orgNo domain scope published2026-11-14
data.khanacademy.orgNo domain scope published2026-11-14
data-labeling.khanacademy.orgNo domain scope published2026-11-14
data-labeling-test.khanacademy.orgtestNo domain scope published2026-11-14
de.khanacademy.orgNo domain scope published2026-11-14
de-de.khanacademy.orgNo domain scope published2026-11-14
wildcard.de.khanacademy.orgNo domain scope published2026-11-14
dev.khanacademy.orgdevNo domain scope published2026-11-14
devops.khanacademy.orgNo domain scope published2026-11-14
devops2.khanacademy.orgNo domain scope published2026-11-14
devopsalan.khanacademy.orgNo domain scope published2026-11-14
districtpartnerships.khanacademy.orgNo domain scope published2026-11-14
districts.khanacademy.orgNo domain scope published2026-11-14
dnm.khanacademy.orgNo domain scope published2026-11-14
dns.khanacademy.orgNo domain scope published2026-11-14
dns1.khanacademy.orgNo domain scope published2026-11-14
dns2.khanacademy.orgNo domain scope published2026-11-14
docker.khanacademy.orgtoolsNo domain scope published2026-11-14
donate.khanacademy.orgNo domain scope published2026-11-14
dyn.khanacademy.orgNo domain scope published2026-11-14
click.e.khanacademy.orgNo domain scope published2026-11-14
cloud.e.khanacademy.orgNo domain scope published2026-11-14
image.e.khanacademy.orgNo domain scope published2026-11-14
mta.e.khanacademy.orgNo domain scope published2026-11-14
mta2.e.khanacademy.orgNo domain scope published2026-11-14
mta3.e.khanacademy.orgNo domain scope published2026-11-14
view.e.khanacademy.orgNo domain scope published2026-11-14
early.khanacademy.orgNo domain scope published2026-11-14
el.khanacademy.orgNo domain scope published2026-11-14
wildcard.el.khanacademy.orgNo domain scope published2026-11-14
elastic.khanacademy.orgdataNo domain scope published2026-11-14
email.khanacademy.orgNo domain scope published2026-11-14
emails.khanacademy.orgNo domain scope published2026-11-14
en.khanacademy.orgNo domain scope published2026-11-14
engineering.khanacademy.orgNo domain scope published2026-11-14
error-monitor-db.khanacademy.orgdata, monitoringNo domain scope published2026-11-14
es.khanacademy.orgNo domain scope published2026-11-14
es-es.khanacademy.orgNo domain scope published2026-11-14
wildcard.es.khanacademy.orgNo domain scope published2026-11-14
www.es.khanacademy.orgNo domain scope published2026-11-14
exchange.khanacademy.orgmailNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated