Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Web cache poisoning attack leads to user information and more#492841 | No longer public | Postmates | Misconfiguration and Insecure Design | – | – | $500 | 343 |
| Cross-site Scripting (XSS) - Stored in RDoc wiki pagesAnalysed#662287 | Valid | GitLab | Misconfiguration and Insecure Design | High | 2019-12-16 | $3,500 | 282 |
| Bruteforce password recovery codeAnalysed#743545 | Valid | Bumble | Misconfiguration and Insecure Design | – | 2020-01-18 | – | 258 |
| Spring Actuator endpoints publicly available and broken authenticationAnalysed#838635 | Valid | LY Corporation | Misconfiguration and Insecure Design | Critical | 2020-08-06 | $12,500 | 234 |
| Internal Access to Hackerone confluence DocsAnalysed#3113398 | Valid | HackerOne | Misconfiguration and Insecure Design | High | 2025-08-15 | $12,500 | 227 |
| Ability To Delete User(s) Account Without User InteractionAnalysed#928255 | Valid | GitLab | Misconfiguration and Insecure Design | High | 2021-03-17 | – | 221 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | HackerOne | Misconfiguration and Insecure Design | Medium | 2021-03-25 | – | 194 |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsAnalysed#815085 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2024-02-04 | $3,750 | 176 |
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2016-09-20 | – | 154 |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPAnalysed#207042 | Valid | HackerOne | Misconfiguration and Insecure Design | – | 2017-08-29 | – | 153 |
| Access Token Smuggling from my.playstation.com via Referer HeaderAnalysed#835437 | Valid | PlayStation | Misconfiguration and Insecure Design | High | 2021-01-12 | $1,000 | 147 |
| Twitter Periscope Clickjacking VulnerabilityAnalysed#591432 | Valid | X / xAI | Misconfiguration and Insecure Design | Medium | 2019-07-10 | $1,120 | 144 |
| Spring Actuator endpoints publicly available, leading to account takeoverAnalysed#862589 | Valid | LY Corporation | Misconfiguration and Insecure Design | Critical | 2020-08-04 | $5,000 | 143 |
| Account Takeover at worki.ru#725707 | No longer public | Mail.ru | Misconfiguration and Insecure Design | – | 2019-12-17 | $1,500 | 143 |
| Highly wormable clickjacking in player cardAnalysed#85624 | Valid | X / xAI | Misconfiguration and Insecure Design | – | 2018-05-17 | – | 134 |
| Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageAnalysed#748903 | Valid | Semrush | Misconfiguration and Insecure Design | Medium | 2020-01-10 | – | 133 |
| Session Cookie Leakage via Static Header Field in WebViewerFragmentAnalysed#3475626 | Valid | Misconfiguration and Insecure Design | High | 2026-03-17 | – | 131 | |
| Email Verification bypass on signupAnalysed#1040047 | Valid | Automattic | Misconfiguration and Insecure Design | High | 2020-12-03 | – | 127 |
| Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domainAnalysed#207170 | Valid | Slack | Misconfiguration and Insecure Design | – | 2017-02-28 | – | 120 |
| Wordpress unzip_file path traversalAnalysed#205481 | Valid | WordPress | Misconfiguration and Insecure Design | Medium | 2020-01-29 | – | 119 |
| [Critical] Delete any account#158872 | No longer public | OLX | Misconfiguration and Insecure Design | – | 2016-09-01 | – | 115 |
| IDOR leading to downloading of any attachmentAnalysed#668439 | Valid | BCM Messenger | Misconfiguration and Insecure Design | Low | 2020-04-11 | – | 114 |
| Subdomain takeover on http://fastly.sc-cdn.net/Analysed#154425 | Valid | Snapchat | Misconfiguration and Insecure Design | – | 2016-08-22 | $3,000 | 114 |
| Leak of authorization urls leads to account takeoverAnalysed#746186 | Valid | Bumble | Misconfiguration and Insecure Design | – | 2020-05-08 | – | 109 |
| Recently added 'Country' field doesn't send email notification when changedAnalysed#961841 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2020-08-25 | – | 108 |
| Wordpress Takeover using setup configuration at http://████.edu [HtUS]Analysed#1626205 | Valid | U.S. Dept Of Defense | Misconfiguration and Insecure Design | Critical | 2023-01-13 | $1,000 | 102 |
| Mass account takeover!Analysed#1634165 | Valid | Stripe | Misconfiguration and Insecure Design | High | 2022-12-21 | – | 101 |
| Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Analysed#1258871 | Valid | Shopify | Misconfiguration and Insecure Design | Medium | 2022-12-02 | $6,300 | 101 |
| Cross-origin resource sharing misconfig | steal user informationAnalysed#235200 | Valid | Semrush | Misconfiguration and Insecure Design | Medium | 2017-12-17 | – | 97 |
| Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cashAnalysed#331940 | Valid | Vend VDP | Misconfiguration and Insecure Design | Medium | 2018-06-07 | – | 96 |
| Password not checked when disabling 2FA on HackerOneAnalysed#587910 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2019-06-07 | – | 95 |
| Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverAnalysed#1883806 | Valid | Uber | Misconfiguration and Insecure Design | Medium | 2023-08-23 | – | 90 |
| Clickjacking on donation pageAnalysed#921709 | Valid | WordPress | Misconfiguration and Insecure Design | Low | 2020-07-16 | – | 90 |
| Send Fax from Anyone's HelloFax Account Due to Misconfigured Email Validation#1428385 | No longer public | Dropbox | Misconfiguration and Insecure Design | – | – | $4,913 | 85 |
| CORS misconfiguration allows to steal customers data#577969 | No longer public | LocalTapiola | Misconfiguration and Insecure Design | – | 2019-11-21 | – | 84 |
| Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.Analysed#2234420 | Valid | Khan Academy | Misconfiguration and Insecure Design | Low | 2023-12-22 | – | 83 |
| Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileAnalysed#2553026 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2025-03-13 | – | 82 |
| Cache Poisoning via uppercase letters in invalid path#960618 | No longer public | InnoGames | Misconfiguration and Insecure Design | – | – | $550 | 82 |
| User password left in memory in plain text after GUI launch#761480 | No longer public | Nord Security | Misconfiguration and Insecure Design | – | 2021-01-24 | – | 82 |
| [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse#2241266 | Informative | HackerOne | Misconfiguration and Insecure Design | Medium | 2024-05-30 | – | 81 |
| Subdomain takeover in Gitlab pagesAnalysed#2523654 | Valid | GitLab | Misconfiguration and Insecure Design | Low | 2024-10-09 | – | 79 |
| Subdomain takeover on one of the subdomain under mozaws.netAnalysed#2269867 | Valid | Mozilla | Misconfiguration and Insecure Design | Medium | 2024-01-04 | – | 79 |
| Broken Link on Urban Company's Vulnerability Submission FormAnalysed#1239334 | Valid | Urban Company | Misconfiguration and Insecure Design | Low | 2021-06-21 | – | 79 |
| Cache Poisoning DoS on updates.rockstargames.comAnalysed#1219038 | Valid | Rockstar Games | Misconfiguration and Insecure Design | Medium | 2021-12-22 | – | 77 |
| Ability to verify any email address you don't own - accounts.shopify.comAnalysed#229619 | Valid | Shopify | Misconfiguration and Insecure Design | – | 2019-11-08 | – | 76 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310 | Valid | HackerOne | Misconfiguration and Insecure Design | None | 2016-12-08 | – | 76 |
| Subdomain takeover on a subdomain under firefox.comAnalysed#2899858 | Valid | Mozilla | Misconfiguration and Insecure Design | Medium | 2025-07-03 | $500 | 75 |
| Authorization Token on PlayStation Network Leaks via postMessage functionAnalysed#826394 | Valid | PlayStation | Misconfiguration and Insecure Design | High | 2020-11-21 | $1,000 | 74 |
| Error Page Content Spoofing or Text InjectionAnalysed#498562 | Valid | Smule | Misconfiguration and Insecure Design | Low | 2020-06-03 | – | 74 |
| Remove obsolete domain from handbook subdomainAnalysed#2599840 | Valid | GitLab | Misconfiguration and Insecure Design | Low | 2024-10-01 | – | 72 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.