Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Internal Access to Hackerone confluence DocsAnalysed#3113398 | Valid | Misconfiguration and Insecure Design | High | 2025-08-15 | $12,500 | 227 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | Misconfiguration and Insecure Design | – | 2021-03-25 | – | 194 |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsAnalysed#815085 | Valid | Misconfiguration and Insecure Design | – | 2024-02-04 | $3,750 | 176 |
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | Misconfiguration and Insecure Design | – | 2016-09-20 | – | 154 |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPAnalysed#207042 | Valid | Misconfiguration and Insecure Design | – | 2017-08-29 | – | 153 |
| Recently added 'Country' field doesn't send email notification when changed#961841 | Valid | Misconfiguration and Insecure Design | – | 2020-08-25 | – | 108 |
| Password not checked when disabling 2FA on HackerOne#587910 | Valid | Misconfiguration and Insecure Design | – | 2019-06-07 | – | 95 |
| Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile#2553026 | Valid | Misconfiguration and Insecure Design | Low | 2025-03-13 | – | 82 |
| [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse#2241266 | Informative | Misconfiguration and Insecure Design | Medium | 2024-05-30 | – | 81 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)#170310 | Valid | Misconfiguration and Insecure Design | – | 2016-12-08 | – | 76 |
| Homograph fix Bypass#271324 | Valid | Misconfiguration and Insecure Design | – | 2017-10-16 | – | 71 |
| Parameter pollution in social sharing buttons#105953 | Valid | Misconfiguration and Insecure Design | – | 2015-12-19 | $500 | 62 |
| Invalid Host detection at https://hackerone.com/redirect#278095 | Valid | Misconfiguration and Insecure Design | – | 2017-12-03 | – | 57 |
| Register & create a ticket as somebody else on HackerOne Support#2082680 | Valid | Misconfiguration and Insecure Design | None | 2023-07-31 | – | 56 |
| 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.#2000000 | Valid | Misconfiguration and Insecure Design | Low | 2023-07-11 | – | 54 |
| Missing SPF for hackerone.com#120 | Valid | Misconfiguration and Insecure Design | – | 2014-01-09 | – | 48 |
| Content Security Policy not applied to error pages at multiple HackerOne endpoints#250729 | Valid | Misconfiguration and Insecure Design | – | 2017-12-12 | – | 45 |
| Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com#199779 | Valid | Misconfiguration and Insecure Design | – | 2017-03-26 | – | 44 |
| Private program email forwarding response invitation not expire after first use.#209140 | Valid | Misconfiguration and Insecure Design | – | 2018-05-30 | – | 38 |
| Ability to bulk submit reports via query named based batching#2166697 | Valid | Misconfiguration and Insecure Design | Low | 2024-06-19 | $500 | 37 |
| Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion#297181 | Valid | Misconfiguration and Insecure Design | – | 2018-01-22 | $500 | 37 |
| HackerOne Integrations Design Issue#172289 | Valid | Misconfiguration and Insecure Design | – | 2019-04-11 | $500 | 36 |
| Updating payout preference to CurrencyCloud doesn't notify user via email#240083 | Valid | Misconfiguration and Insecure Design | – | 2018-01-31 | $500 | 35 |
| CSRF at [Apply to this program] that lead to submit your request automatic with out any validations#334253 | Valid | Misconfiguration and Insecure Design | – | 2018-07-05 | – | 30 |
| Email spoofing#575 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 28 |
| Report redaction doesn't apply to report title update activities#196358 | Valid | Misconfiguration and Insecure Design | – | 2017-02-25 | – | 27 |
| 2fa can't be activated on app.pullrequest.com#2463069 | Informative | Misconfiguration and Insecure Design | None | 2024-07-11 | – | 25 |
| Introspection query leaks sensitive graphql system information.#291531 | Duplicate | Misconfiguration and Insecure Design | – | 2017-11-22 | – | 22 |
| HTML injection can lead to data theft#110578 | Valid | Misconfiguration and Insecure Design | – | 2016-01-26 | $500 | 21 |
| Homograph attack in escalate report#143975 | Valid | Misconfiguration and Insecure Design | – | 2019-04-19 | – | 20 |
| Enumeration of users#761 | Informative | Misconfiguration and Insecure Design | – | 2014-10-03 | – | 20 |
| www.hackerone.com website CSP "script-src" includes "unsafe-inline"#225833 | Valid | Misconfiguration and Insecure Design | – | 2017-05-23 | – | 17 |
| Example HackerOne security@ forward domain is not registered#218705 | Valid | Misconfiguration and Insecure Design | – | 2017-04-10 | – | 17 |
| Previous attachments can be referenced when creating a new report#129773 | Valid | Misconfiguration and Insecure Design | – | 2019-04-12 | – | 17 |
| Homograph attack#59375 | Valid | Misconfiguration and Insecure Design | – | 2015-05-09 | – | 17 |
| Enumerating HackerOne Pentests#1139541 | Informative | Misconfiguration and Insecure Design | – | 2021-08-25 | – | 16 |
| Password Reset Bug#8082 | Valid | Misconfiguration and Insecure Design | – | 2014-09-25 | $100 | 16 |
| Able to remove the admin access of my program#141629 | Valid | Misconfiguration and Insecure Design | – | 2016-07-06 | – | 15 |
| Session not invalidated after password reset#15785 | Valid | Misconfiguration and Insecure Design | – | 2014-06-10 | – | 15 |
| Logical issues with account settings#546 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 15 |
| Race Conditions Exist When Accepting Invitations#119354 | Valid | Misconfiguration and Insecure Design | – | 2016-04-26 | – | 14 |
| Gain reputation by creating a duplicate of an existing report#35237 | Valid | Misconfiguration and Insecure Design | – | 2015-08-14 | – | 14 |
| Control Characters Not Stripped From Username on Signup#3227 | Valid | Misconfiguration and Insecure Design | – | 2014-03-11 | – | 14 |
| javascript: and mailto: links are allowed in JIRA integration settings#209917 | Duplicate | Misconfiguration and Insecure Design | – | 2017-04-10 | – | 12 |
| Manipulate report timeline activity by using null byte.#133322 | Informative | Misconfiguration and Insecure Design | – | 2016-07-01 | – | 12 |
| Improve signals in reputation#106305 | Valid | Misconfiguration and Insecure Design | – | 2016-01-07 | – | 12 |
| homograph attack. IDNs displayed in unicode in bug reports and on external link warning page#29491 | Valid | Misconfiguration and Insecure Design | – | 2014-10-09 | $500 | 12 |
| All Active user sessions should be deleted when user change his password!#9950 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | $100 | 11 |
| Privilege escalation..., or not?!#345 | Valid | Misconfiguration and Insecure Design | – | 2015-06-08 | – | 11 |
| RTL override symbol not stripped from file names#298 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 11 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.