Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
27
Disclosed reports
72
Subdomains
23,159
Vendor on CyberSIXT
Reddit (1 CVE, 0 exploited)

Most upvoted reports72

All reports
Most upvoted reports of Reddit
ReportWeaknessDisclosedBountyVotes
One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186Access Control2022-08-02–509
[accounts.reddit.com] Redirect parameter allows for XSSAnalysed#1962645Cross-site Scripting2023-05-18$5,000394
Blind SSRF to internal services in matrix preview_link APIAnalysed#1960765Server-Side Request Forgery2023-04-26$6,000344
Exposed proxy allows to access internal reddit domainsAnalysed#2967634Access Control2025-02-24$7,500296
RichText parser vulnerability in scheduled posts allows XSSAnalysed#1930763Cross-site Scripting2023-04-20$5,000280
Deleting all DMs on RedditGifts.comAnalysed#1213237Insecure Direct Object Reference2021-10-21$5,000267
Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237Cryptography2024-02-06–238
XSS via Mod Log Removed PostsAnalysed#1504410Cross-site Scripting2022-03-10–218
IDOR allows an attacker to modify the links of any userAnalysed#1661113Insecure Direct Object Reference2022-09-30–208
Able to bypass email verification and change email to any other user emailAnalysed#1551176Access Control2022-05-06$5,000200

Subdomains23,159

Subdomains of Reddit
NameScopeFirst seen
adm.reddit.comadminIn scope2026-11-14
www.adm.reddit.comadminIn scope2026-11-14
adm2.reddit.comadminIn scope2026-11-14
admin.reddit.comadminIn scope2026-11-14
autoconfig.admin.reddit.comadminIn scope2026-11-14
autodiscover.admin.reddit.comadmin, mailIn scope2026-11-14
beta.admin.reddit.comadmin, stagingIn scope2026-11-14
builder.admin.reddit.comadminIn scope2026-11-14
dev.admin.reddit.comadmin, devIn scope2026-11-14
webdisk.admin.reddit.comadminIn scope2026-11-14
webmail.admin.reddit.comadmin, mailIn scope2026-11-14
www.admin.reddit.comadminIn scope2026-11-14
admin01.reddit.comadminIn scope2026-11-14
admin1.reddit.comadminIn scope2026-11-14
admin2.reddit.comadminIn scope2026-11-14
admin3.reddit.comadminIn scope2026-11-14
admin5.reddit.comadminIn scope2026-11-14
admin6.reddit.comadminIn scope2026-11-14
administration.reddit.comadminIn scope2026-11-14
administrator.reddit.comadminIn scope2026-11-14
backoffice.reddit.comadminIn scope2026-11-14
cms.reddit.comadminIn scope2026-11-14
www.cms.reddit.comadminIn scope2026-11-14
cms1.reddit.comadminIn scope2026-11-14
cms2.reddit.comadminIn scope2026-11-14
cms3.reddit.comadminIn scope2026-11-14
console.reddit.comadminIn scope2026-11-14
cpanel.reddit.comadminIn scope2026-11-14
builder.cpanel.reddit.comadminIn scope2026-11-14
webmail.cpanel.reddit.comadmin, mailIn scope2026-11-14
www.cpanel.reddit.comadminIn scope2026-11-14
cpanel1.reddit.comadminIn scope2026-11-14
cpanel2.reddit.comadminIn scope2026-11-14
cpanel3.reddit.comadminIn scope2026-11-14
dashboard.reddit.comadminIn scope2026-11-14
www.dashboard.reddit.comadminIn scope2026-11-14
dev-admin.reddit.comadmin, devIn scope2026-11-14
admin.dev.reddit.comadmin, devIn scope2026-11-14
antivirus.www-dev.admin.alumni.dev.reddit.comadmin, devIn scope2026-11-14
www.antivirus.www-dev.admin.alumni.dev.reddit.comadmin, devIn scope2026-11-14
admin.m.reddit.comadminIn scope2026-11-14
manage.reddit.comadminIn scope2026-11-14
www.manage.reddit.comadminIn scope2026-11-14
management.reddit.comadminIn scope2026-11-14
www.management.reddit.comadminIn scope2026-11-14
manager.reddit.comadminIn scope2026-11-14
www.manager.reddit.comadminIn scope2026-11-14
admin.old.reddit.comadmin, legacyIn scope2026-11-14
cpanel.old.reddit.comadmin, legacyIn scope2026-11-14
panel.reddit.comadminIn scope2026-11-14
www.panel.reddit.comadminIn scope2026-11-14
panel2.reddit.comadminIn scope2026-11-14
phpmyadmin.reddit.comadminIn scope2026-11-14
www.phpmyadmin.reddit.comadminIn scope2026-11-14
phpmyadmin2.reddit.comadminIn scope2026-11-14
admin.technewstoday.reddit.comadminIn scope2026-11-14
cpanel.technewstoday.reddit.comadminIn scope2026-11-14
admin.test.reddit.comadmin, testIn scope2026-11-14

23,064 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.