Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Captcha Bypass in Coinbase SignUp FormAnalysed#246801 | Valid | Misconfiguration and Insecure Design | Low | 2017-09-05 | $100 | 23 |
| Prepopulation of email address and name leaks information provided to other merchants#316290 | Valid | Misconfiguration and Insecure Design | – | 2018-04-02 | – | 16 |
| Email leak in transcations in Android app#126376 | Valid | Misconfiguration and Insecure Design | – | 2016-05-17 | $500 | 11 |
| ByPassing the email Validation Email on Sign up process in mobile apps#57764 | Valid | Misconfiguration and Insecure Design | – | 2016-11-28 | $100 | 7 |
| Content Injection error page#148952 | Informative | Misconfiguration and Insecure Design | – | 2017-01-05 | – | 6 |
| window.opener is leaking to external domains upon redirect on Safari#160498 | Valid | Misconfiguration and Insecure Design | – | 2016-08-22 | – | 5 |
| Create Multiple Account Using Similar X-CSRF token#155726 | N/A | Misconfiguration and Insecure Design | – | 2016-08-09 | – | 5 |
| 2FA settings allowed to be changed with no delay/freeze on funds#16696 | Informative | Misconfiguration and Insecure Design | – | 2014-08-25 | – | 5 |
| User Enumeration, Information Disclosure and Lack of Rate Limitation on API#5200 | Informative | Misconfiguration and Insecure Design | – | 2014-03-31 | – | 4 |
| Sandboxed iframes don't show confirmation screen#54733 | Valid | Misconfiguration and Insecure Design | – | 2015-04-04 | – | 3 |
| Multiple Issues related to registering applications#5933 | Valid | Misconfiguration and Insecure Design | – | 2014-05-29 | $1,000 | 3 |
| User's legal name could be changed despite front end controls being disabled#131192 | Valid | Misconfiguration and Insecure Design | – | 2016-05-05 | – | 2 |
| 2 factor authentication design flaw#7369 | Valid | Misconfiguration and Insecure Design | – | 2014-06-06 | – | 2 |
| X-Frame-Options#237071 | Informative | Misconfiguration and Insecure Design | None | 2017-06-22 | – | 1 |
| SPF records not found#92740 | Valid | Misconfiguration and Insecure Design | – | 2015-10-14 | – | 1 |
| Runtime manipulation iOS app breaking the PIN#80512 | Informative | Misconfiguration and Insecure Design | – | 2016-11-16 | – | 1 |
| iframes considered harmful#55827 | Informative | Misconfiguration and Insecure Design | – | 2015-12-01 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.