Bug bounty program · HackerOne
Most upvoted reports19
- #894922Valid[3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacksNintendo · Cryptography · 2020–129votes
- #3463719ValidASLR leak in Mario Kart World through LAN modeNintendo · Information Disclosure · 2026 · High–74votes
- #3062122Valid[Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotelyNintendo · Injection and Smuggling · 2025 · Critical–65votes
- #3559522ValidSplatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer SubmissionNintendo · Input Validation and Logic · 2026 · High–62votes
- #3042475ValidSplatoon 3 Anticheat Seed Randomization WeaknessNintendo · Cryptography · 2026–55votes
- #3174987ValidMan-in-the-middle through broken SSL certificate verificationNintendo · Cryptography · 2025 · Medium–53votes
- #897606Valid[3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie playerNintendo · Memory Corruption · 2020–43votes
- #2551512Duplicate[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCENintendo · Memory Corruption · 2026 · Low–42votes
- #3052880Valid[Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filterNintendo · No weakness recorded · 2025 · Medium–40votes
- #895769Valid[3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie playerNintendo · Memory Corruption · 2020–38votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.