Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Banner status override by advertiser‑level users#3678828 | Valid | Access Control | Medium | 2026-06-03 | – | 5 |
| Missing access control when modifying parent entities via XML‑RPC#3677576 | Valid | Access Control | Medium | 2026-06-03 | – | 7 |
| XML‑RPC login leak exposes valid session ID enabling unauthorized API accessAnalysed#3783738 | Valid | Access Control | Medium | 2026-06-25 | – | 28 |
| Authorization bypass allows changing email address of other usersAnalysed#3398283 | Valid | Access Control | High | 2025-11-19 | – | 35 |
| Missing access control when linking trackers to campaignsAnalysed#3650582 | Valid | Access Control | Medium | 2026-06-03 | – | 35 |
| Missing access control when linking banners or campaigns to zonesAnalysed#3650504 | Valid | Access Control | Medium | 2026-06-03 | – | 42 |
| Broken Access Control allows advertiser accounts to delete trackers they do not ownAnalysed#3445710 | Valid | Access Control | High | 2026-01-14 | – | 47 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.