Bug bounty program

Khan Academy

Platform: HackerOne
Bounties: None
Assets in scope: 0
Disclosed reports: 71
Subdomains: 382

Most upvoted reports71

Most upvoted reports of Khan Academy
Report	Weakness	Disclosed	Bounty	Votes
Take over of accounts created using Google or FacebookAnalysed#442901	Cross-Site Request Forgery	2019-05-17	–	184
1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationAnalysed#3723458	Access Control	2026-06-20	–	126
Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversAnalysed#419891	Cross-Site Request Forgery	2019-06-22	–	111
Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Analysed#3080597	Cryptography	2025-05-07	–	107
Leaked reused password for a few Khan Academy usersAnalysed#3099978	Cryptography	2025-07-12	–	92
337k users and 1 employee leaked credentialsAnalysed#3250691	Information Disclosure	2025-09-10	–	87
XSS on using the legacy "Graphie To Png" APIAnalysed#2846011	Cross-site Scripting	2025-02-06	–	86
Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Analysed#2234420	Misconfiguration and Insecure Design	2023-12-22	–	83
Account takeover by changing emailAnalysed#538800	Cross-Site Request Forgery	2019-05-17	–	80
Enumerate all the class codes via google dorkingAnalysed#1210043	Access Control	2021-07-22	–	44

Subdomains382

Root

khanacademy.org382

Scope:No domain scope published

Name suggests:Development

First seen

Text fileClear filters2 names

Subdomains of Khan Academy
Name	Scope	First seen
dev.khanacademy.orgdev	No domain scope published	2026-11-14
localhost.khanacademy.orgdev	No domain scope published	2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.