Bug bounty program · HackerOne
Most upvoted reports239
- #542340ValidAnalysedSensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterUber · Information Disclosure · 2019 · needs: no account · Missing authorisation check, IDOR / object reference, Leaked secret or key–643votes
- #591813ValidAnalysed[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoUber · Information Disclosure · 2021 · needs: no account · Leaked secret or key$40,000458votes
- #202781ValidAnalysedChained Bugs to Leak Victim's Uber's FB Oauth TokenUber · Authentication · 2019 · needs: no account · OAuth redirect_uri abuse, Account takeover chain–427votes
- #340431ValidAnalysedReflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgUber · Cryptography · 2020 · needs: not clear from the report · Reflected XSS, Information disclosure$4,000376votes
- #1007014ValidAnalysedRCE via npm misconfig -- installing internal libraries from the public registryUber · Command and Code Injection · 2021 · needs: no account · Dependency confusion / supply chain, Code injection / eval$9,000325votes
- #143717ValidAnalysedChange any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Uber · Authentication · 2016 · needs: no account · Authentication bypass, Account takeover chain, Password reset flaw–312votes
- #156098N/AXSS At "pages.et.uber.com"Uber · Cross-site Scripting · 2016–267votes
- #131450ValidStored XSS in developer.uber.comUber · Cross-site Scripting · 2016$7,500223votes
- #530441ValidUnauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Uber · Access Control · 2021$4,500210votes
- #219205ValidAuthentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comUber · Authentication · 2017–183votes
Subdomains11,395
0 covered by the program's own scope · 0 first seen this week
Roots:uber.com 11,395
Name suggestsAnything
11,395 names
| Name | Scope | First seen |
|---|---|---|
| 00t.uber.com | Not in the scope | 2026-11-14 |
| 01th.uber.com | Not in the scope | 2026-11-14 |
| 033michelangelo.uber.com | Not in the scope | 2026-11-14 |
| 035michelangelo.uber.com | Not in the scope | 2026-11-14 |
| 036michelangelo.uber.com | Not in the scope | 2026-11-14 |
| 05th.uber.com | Not in the scope | 2026-11-14 |
| 06th.uber.com | Not in the scope | 2026-11-14 |
| 06th3.uber.com | Not in the scope | 2026-11-14 |
| 07rtners.uber.com | Not in the scope | 2026-11-14 |
| 07th.uber.com | Not in the scope | 2026-11-14 |
| 087123accounts.uber.com | Not in the scope | 2026-11-14 |
| 0871get.uber.com | Not in the scope | 2026-11-14 |
| 08th.uber.com | Not in the scope | 2026-11-14 |
| 08w.uber.com | Not in the scope | 2026-11-14 |
| 0cth.uber.com | Not in the scope | 2026-11-14 |
| 0yzauth.uber.com | Not in the scope | 2026-11-14 |
| 13w.uber.com | Not in the scope | 2026-11-14 |
| 14th.uber.com | Not in the scope | 2026-11-14 |
| 15205598.uber.com | Not in the scope | 2026-11-14 |
| 15sanfauth.uber.com | Not in the scope | 2026-11-14 |
| 16w.uber.com | Not in the scope | 2026-11-14 |
| 17w.uber.com | Not in the scope | 2026-11-14 |
| 18th.uber.com | Not in the scope | 2026-11-14 |
| 1pth.uber.com | Not in the scope | 2026-11-14 |
| 2.uber.com | Not in the scope | 2026-11-14 |
| 2026investor.uber.com | Not in the scope | 2026-11-14 |
| 21counts.uber.com | Not in the scope | 2026-11-14 |
| 21th.uber.com | Not in the scope | 2026-11-14 |
| 22account.uber.com | Not in the scope | 2026-11-14 |
| 22auth.uber.comauth | Not in the scope | 2026-11-14 |
| 22beta.uber.comstaging | Not in the scope | 2026-11-14 |
| 22bonjour.uber.com | Not in the scope | 2026-11-14 |
| 22business.uber.com | Not in the scope | 2026-11-14 |
| 22business-beta.uber.comstaging | Not in the scope | 2026-11-14 |
| 22businesses.uber.com | Not in the scope | 2026-11-14 |
| 22charter.uber.com | Not in the scope | 2026-11-14 |
| 22direct.uber.com | Not in the scope | 2026-11-14 |
| 22direct-beta.uber.comstaging | Not in the scope | 2026-11-14 |
| 22drivers.uber.com | Not in the scope | 2026-11-14 |
| 22event.uber.com | Not in the scope | 2026-11-14 |
| 22freightbonjour.uber.com | Not in the scope | 2026-11-14 |
| 22get.uber.com | Not in the scope | 2026-11-14 |
| 22guest.uber.com | Not in the scope | 2026-11-14 |
| 22m.uber.com | Not in the scope | 2026-11-14 |
| 22mobility-webview.uber.com | Not in the scope | 2026-11-14 |
| 22partners.uber.com | Not in the scope | 2026-11-14 |
| 22paypay.uber.com | Not in the scope | 2026-11-14 |
| 22po.uber.com | Not in the scope | 2026-11-14 |
| 22reimagine.uber.com | Not in the scope | 2026-11-14 |
| 22restaurant.uber.com | Not in the scope | 2026-11-14 |
| 22tb-static.uber.com | Not in the scope | 2026-11-14 |
| 22thankatruckdriver.uber.com | Not in the scope | 2026-11-14 |
| 22transit.uber.com | Not in the scope | 2026-11-14 |
| 22transit-beta.uber.comstaging | Not in the scope | 2026-11-14 |
| 22vouchers.uber.com | Not in the scope | 2026-11-14 |
| 22xlb.uber.com | Not in the scope | 2026-11-14 |
| 22xlb-beta.uber.comstaging | Not in the scope | 2026-11-14 |
| 234auth.uber.comauth | Not in the scope | 2026-11-14 |
| 23auth.uber.comauth | Not in the scope | 2026-11-14 |
| 26gin.uber.com | Not in the scope | 2026-11-14 |
| 27th.uber.com | Not in the scope | 2026-11-14 |
| 29auth.uber.comauth | Not in the scope | 2026-11-14 |
| 29njour.uber.com | Not in the scope | 2026-11-14 |
| 2feng.uber.com | Not in the scope | 2026-11-14 |
| 2flogin.uber.com | Not in the scope | 2026-11-14 |
| 2fm.uber.com | Not in the scope | 2026-11-14 |
| 2frush.uber.com | Not in the scope | 2026-11-14 |
| 30th.uber.com | Not in the scope | 2026-11-14 |
| 30w.uber.com | Not in the scope | 2026-11-14 |
| 31th.uber.com | Not in the scope | 2026-11-14 |
| 323272auth.uber.comauth | Not in the scope | 2026-11-14 |
| 3254005login.uber.comauth | Not in the scope | 2026-11-14 |
| 32th.uber.com | Not in the scope | 2026-11-14 |
| 331759.uber.com | Not in the scope | 2026-11-14 |
| 33th.uber.com | Not in the scope | 2026-11-14 |
| 36mz.uber.com | Not in the scope | 2026-11-14 |
| 36th3.uber.com | Not in the scope | 2026-11-14 |
| 3945620login.uber.comauth | Not in the scope | 2026-11-14 |
| 394565auth.uber.comauth | Not in the scope | 2026-11-14 |
| 3956794auth3.uber.comauth | Not in the scope | 2026-11-14 |
| 398414auth.uber.comauth | Not in the scope | 2026-11-14 |
| 39rtners.uber.com | Not in the scope | 2026-11-14 |
| 401372auth.uber.comauth | Not in the scope | 2026-11-14 |
| 4035385auth.uber.comauth | Not in the scope | 2026-11-14 |
| 405452auth.uber.comauth | Not in the scope | 2026-11-14 |
| 40th.uber.com | Not in the scope | 2026-11-14 |
| 41count.uber.com | Not in the scope | 2026-11-14 |
| 41th.uber.com | Not in the scope | 2026-11-14 |
| 41w.uber.com | Not in the scope | 2026-11-14 |
| 42th.uber.com | Not in the scope | 2026-11-14 |
| 42w.uber.com | Not in the scope | 2026-11-14 |
| 43th.uber.com | Not in the scope | 2026-11-14 |
| 446175auth.uber.comauth | Not in the scope | 2026-11-14 |
| 446323auth.uber.comauth | Not in the scope | 2026-11-14 |
| 4479393auth3.uber.comauth | Not in the scope | 2026-11-14 |
| 448748auth.uber.comauth | Not in the scope | 2026-11-14 |
| 450645auth.uber.comauth | Not in the scope | 2026-11-14 |
| 454725auth.uber.comauth | Not in the scope | 2026-11-14 |
| 455963auth.uber.comauth | Not in the scope | 2026-11-14 |
| 458737auth.uber.comauth | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.