Bug bounty program · HackerOne
Most upvoted reports11
- #1842674ValidSQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.aiKrisp · Deserialization and Object Injection · 2023–119votes
- #1608151ValidAuthentication bypass for ███ leads to take over any users account.Krisp · Authentication · 2022–48votes
- #1267476ValidAuthentication CSRF resulting in unauthorized account access on Krisp appKrisp · Authentication · 2022–35votes
- #1446090ValidAdd more seats by paying less via PUT /v2/seats request manipulationKrisp · Input Validation and Logic · 2022–30votes
- #1418419Valid[api.krisp.ai] Race condition on /v2/seats endpoint allows bypassing the original seat limitKrisp · Race Conditions · 2022–26votes
- #1670304ValidCard requirement bypass for business trialKrisp · Access Control · 2022–22votes
- #1431624InformativeLog4j CVE-2021–44228Krisp · Command and Code Injection · 2021–21votes
- #1450014DuplicateVisibility Robots.txt fileKrisp · Information Disclosure · 2022–19votes
- #1420070ValidForce User to Accept Attacker's invite [ Restrict user to create account]Krisp · Access Control · 2022–10votes
- #1444031InformativeError Page Content Spoofing or Text InjectionKrisp · Misconfiguration and Insecure Design · 2022–8votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.