Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Internal Access to Hackerone confluence DocsAnalysed#3113398 | Valid | Misconfiguration and Insecure Design | High | 2025-08-15 | $12,500 | 227 |
| Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosAnalysed#1034257 | Valid | Misconfiguration and Insecure Design | Medium | 2021-03-25 | – | 194 |
| Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsAnalysed#815085 | Valid | Misconfiguration and Insecure Design | Low | 2024-02-04 | $3,750 | 176 |
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | Misconfiguration and Insecure Design | Low | 2016-09-20 | – | 154 |
| Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPAnalysed#207042 | Valid | Misconfiguration and Insecure Design | – | 2017-08-29 | – | 153 |
| Recently added 'Country' field doesn't send email notification when changedAnalysed#961841 | Valid | Misconfiguration and Insecure Design | Low | 2020-08-25 | – | 108 |
| Password not checked when disabling 2FA on HackerOneAnalysed#587910 | Valid | Misconfiguration and Insecure Design | Low | 2019-06-07 | – | 95 |
| Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on MobileAnalysed#2553026 | Valid | Misconfiguration and Insecure Design | Low | 2025-03-13 | – | 82 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310 | Valid | Misconfiguration and Insecure Design | None | 2016-12-08 | – | 76 |
| Homograph fix BypassAnalysed#271324 | Valid | Misconfiguration and Insecure Design | Medium | 2017-10-16 | – | 71 |
| Parameter pollution in social sharing buttonsAnalysed#105953 | Valid | Misconfiguration and Insecure Design | – | 2015-12-19 | $500 | 62 |
| Invalid Host detection at https://hackerone.com/redirectAnalysed#278095 | Valid | Misconfiguration and Insecure Design | Low | 2017-12-03 | – | 57 |
| Register & create a ticket as somebody else on HackerOne SupportAnalysed#2082680 | Valid | Misconfiguration and Insecure Design | None | 2023-07-31 | – | 56 |
| 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.Analysed#2000000 | Valid | Misconfiguration and Insecure Design | Low | 2023-07-11 | – | 54 |
| Missing SPF for hackerone.comAnalysed#120 | Valid | Misconfiguration and Insecure Design | – | 2014-01-09 | – | 48 |
| Content Security Policy not applied to error pages at multiple HackerOne endpointsAnalysed#250729 | Valid | Misconfiguration and Insecure Design | Low | 2017-12-12 | – | 45 |
| Google Analytics could be used as CSP bypass for data exfiltration on hackerone.comAnalysed#199779 | Valid | Misconfiguration and Insecure Design | Low | 2017-03-26 | – | 44 |
| Private program email forwarding response invitation not expire after first use.Analysed#209140 | Valid | Misconfiguration and Insecure Design | High | 2018-05-30 | – | 38 |
| Ability to bulk submit reports via query named based batchingAnalysed#2166697 | Valid | Misconfiguration and Insecure Design | Low | 2024-06-19 | $500 | 37 |
| Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestionAnalysed#297181 | Valid | Misconfiguration and Insecure Design | Low | 2018-01-22 | $500 | 37 |
| HackerOne Integrations Design IssueAnalysed#172289 | Valid | Misconfiguration and Insecure Design | Medium | 2019-04-11 | $500 | 36 |
| Updating payout preference to CurrencyCloud doesn't notify user via emailAnalysed#240083 | Valid | Misconfiguration and Insecure Design | None | 2018-01-31 | $500 | 35 |
| CSRF at [Apply to this program] that lead to submit your request automatic with out any validationsAnalysed#334253 | Valid | Misconfiguration and Insecure Design | Low | 2018-07-05 | – | 30 |
| Email spoofingAnalysed#575 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 28 |
| Report redaction doesn't apply to report title update activitiesAnalysed#196358 | Valid | Misconfiguration and Insecure Design | Low | 2017-02-25 | – | 27 |
| HTML injection can lead to data theftAnalysed#110578 | Valid | Misconfiguration and Insecure Design | – | 2016-01-26 | $500 | 21 |
| Homograph attack in escalate reportAnalysed#143975 | Valid | Misconfiguration and Insecure Design | Low | 2019-04-19 | – | 20 |
| www.hackerone.com website CSP "script-src" includes "unsafe-inline"#225833 | Valid | Misconfiguration and Insecure Design | None | 2017-05-23 | – | 17 |
| Example HackerOne security@ forward domain is not registered#218705 | Valid | Misconfiguration and Insecure Design | – | 2017-04-10 | – | 17 |
| Previous attachments can be referenced when creating a new report#129773 | Valid | Misconfiguration and Insecure Design | Low | 2019-04-12 | – | 17 |
| Homograph attack#59375 | Valid | Misconfiguration and Insecure Design | – | 2015-05-09 | – | 17 |
| Password Reset Bug#8082 | Valid | Misconfiguration and Insecure Design | – | 2014-09-25 | $100 | 16 |
| Able to remove the admin access of my program#141629 | Valid | Misconfiguration and Insecure Design | – | 2016-07-06 | – | 15 |
| Session not invalidated after password reset#15785 | Valid | Misconfiguration and Insecure Design | – | 2014-06-10 | – | 15 |
| Logical issues with account settings#546 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 15 |
| Race Conditions Exist When Accepting Invitations#119354 | Valid | Misconfiguration and Insecure Design | – | 2016-04-26 | – | 14 |
| Gain reputation by creating a duplicate of an existing report#35237 | Valid | Misconfiguration and Insecure Design | – | 2015-08-14 | – | 14 |
| Control Characters Not Stripped From Username on Signup#3227 | Valid | Misconfiguration and Insecure Design | – | 2014-03-11 | – | 14 |
| Improve signals in reputation#106305 | Valid | Misconfiguration and Insecure Design | – | 2016-01-07 | – | 12 |
| homograph attack. IDNs displayed in unicode in bug reports and on external link warning page#29491 | Valid | Misconfiguration and Insecure Design | – | 2014-10-09 | $500 | 12 |
| All Active user sessions should be deleted when user change his password!#9950 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | $100 | 11 |
| Privilege escalation..., or not?!#345 | Valid | Misconfiguration and Insecure Design | – | 2015-06-08 | – | 11 |
| RTL override symbol not stripped from file names#298 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 11 |
| New hacktivity view discloses report IDs of non-public reports#127620 | Valid | Misconfiguration and Insecure Design | – | 2016-04-05 | $500 | 10 |
| Reflected File Download#39658 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 10 |
| GraphQL sessions aren't immediately invalidated when user password is changed#283847 | Valid | Misconfiguration and Insecure Design | – | 2017-11-30 | – | 9 |
| Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.#9479 | Valid | Misconfiguration and Insecure Design | – | 2015-04-28 | – | 9 |
| Increase number of bugs by sending duplicate of your own valid report#116951 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 8 |
| Insecure Direct Object Reference vulnerability#46397 | Valid | Misconfiguration and Insecure Design | – | 2015-02-20 | $500 | 8 |
| Logic Issue with Reputation: Boost Reputation Points#36211 | Valid | Misconfiguration and Insecure Design | – | 2015-04-28 | – | 8 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.