Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)#1276733	Informative	Access Control	Low	2021-10-21	–	4
Broken Authendication And Session Management#1167029	N/A	Access Control	–	2021-10-21	–	5
Huge amount of Subdomains Takeovers at Reddit.com#1966262	Duplicate	Access Control	Medium	2023-05-18	–	8
oauth misconfigration lead to account takeover#1815463	Informative	Access Control	–	2023-05-18	–	11
api keys leaked#1762927	Informative	Access Control	Medium	2022-11-10	–	16
Domain Takeover of Reddit.ru via DNS HijackingAnalysed#1226891	Valid	Access Control	Medium	2021-10-21	$500	20
[dubmash] Lack of authorization checks - Update Sound TitlesAnalysed#1102365	Valid	Access Control	High	2021-10-21	–	21
Oauth Misconfiguration Lead To Account Takeover#1212374	Duplicate	Access Control	Medium	2021-10-21	–	21
Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote APIAnalysed#1298902	Valid	Access Control	Low	2021-10-27	–	52
Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Analysed#1596663	Valid	Access Control	High	2022-11-14	–	186
Able to bypass email verification and change email to any other user emailAnalysed#1551176	Valid	Access Control	High	2022-05-06	$5,000	200
Exposed proxy allows to access internal reddit domainsAnalysed#2967634	Valid	Access Control	High	2025-02-24	$7,500	296
One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186	Valid	Access Control	Critical	2022-08-02	–	509

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.