Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| [CSRF] TikTok Careers Portal Account TakeoverAnalysed#1010522 | Valid | TikTok | Cross-Site Request Forgery | High | 2020-12-15 | – | 366 |
| CSRF on connecting Paypal as Payment ProviderAnalysed#807924 | Valid | Shopify | Cross-Site Request Forgery | Medium | 2020-04-10 | – | 304 |
| Account Takeover using Linked Accounts due to lack of CSRF protectionAnalysed#463330 | Valid | Rockstar Games | Cross-Site Request Forgery | High | 2019-02-20 | – | 238 |
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | X / xAI | Cross-Site Request Forgery | Low | 2020-02-21 | $1,540 | 224 |
| Take over of accounts created using Google or FacebookAnalysed#442901 | Valid | Khan Academy | Cross-Site Request Forgery | Critical | 2019-05-17 | – | 184 |
| Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneAnalysed#1727221 | Valid | HackerOne | Cross-Site Request Forgery | High | 2023-06-19 | – | 168 |
| Site wide CSRF affecting both job seeker and Employer account on glassdoor.com#790061 | No longer public | Glassdoor | Cross-Site Request Forgery | – | 2020-12-10 | – | 162 |
| CSRF protection bypass in GitHub Enterprise management consoleAnalysed#1497169 | Valid | GitHub | Cross-Site Request Forgery | High | 2022-04-13 | $10,000 | 152 |
| Slack integration setup lacks CSRF protectionAnalysed#170552 | Valid | HackerOne | Cross-Site Request Forgery | High | 2021-07-07 | $2,500 | 149 |
| SocialClub Account Take Over Through Import Friends featureAnalysed#901728 | Valid | Rockstar Games | Cross-Site Request Forgery | High | 2021-04-01 | – | 116 |
| CSRF token validation system is disabled on Stripe DashboardAnalysed#1483327 | Valid | Stripe | Cross-Site Request Forgery | Medium | 2022-04-02 | – | 113 |
| Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Analysed#787160 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2020-06-24 | – | 112 |
| Cross-Site Request ForgeryAnalysed#2041007 | Valid | ownCloud | Cross-Site Request Forgery | High | 2023-11-05 | – | 111 |
| Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeoversAnalysed#419891 | Valid | Khan Academy | Cross-Site Request Forgery | High | 2019-06-22 | – | 111 |
| CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Analysed#474833 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2020-06-12 | – | 104 |
| Account takeover due to insufficient URL validation on RelayState parameterAnalysed#1923672 | Valid | GitLab | Cross-Site Request Forgery | Medium | 2023-05-30 | $2,450 | 99 |
| One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comAnalysed#1046630 | Valid | Logitech | Cross-Site Request Forgery | Medium | 2021-01-06 | – | 99 |
| CSRF Account TakeoverAnalysed#1253462 | Valid | TikTok | Cross-Site Request Forgery | High | 2022-08-16 | – | 95 |
| CSRF to HTML Injection in CommentsAnalysed#428019 | Valid | WordPress | Cross-Site Request Forgery | High | 2019-05-13 | – | 95 |
| CSRF in Account Deletion feature (https://www.flickr.com/account/delete)Analysed#615448 | Valid | Flickr | Cross-Site Request Forgery | High | 2021-09-14 | – | 92 |
| Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo accountAnalysed#423022 | Valid | Discourse | Cross-Site Request Forgery | High | 2018-12-06 | – | 89 |
| CSRF on /api/graphql allows executing mutations through GET requestsAnalysed#1122408 | Valid | GitLab | Cross-Site Request Forgery | High | 2021-08-02 | $3,370 | 88 |
| [CRITICAL] Full account takeover using CSRFAnalysed#235642 | Valid | X / xAI | Cross-Site Request Forgery | High | 2017-11-03 | – | 88 |
| CSRF leads to Account takeoverAnalysed#2699029 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2024-12-18 | – | 87 |
| CSRF token validation system is disabled on Stripe DashboardAnalysed#1493437 | Valid | Stripe | Cross-Site Request Forgery | Medium | 2022-05-31 | $2,500 | 87 |
| Login CSRF vulnerability on hackerone.comAnalysed#834366 | Valid | HackerOne | Cross-Site Request Forgery | Low | 2020-06-12 | $500 | 84 |
| XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimAnalysed#450796 | Valid | PayPal | Cross-Site Request Forgery | Medium | 2019-02-07 | $3,500 | 81 |
| CSRF in ticket functionAnalysed#1890310 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2024-11-05 | – | 80 |
| Account takeover by changing emailAnalysed#538800 | Valid | Khan Academy | Cross-Site Request Forgery | Critical | 2019-05-17 | – | 80 |
| CSRF protection bypass on TikTok Webcast EndpointsAnalysed#1543234 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2023-07-12 | $2,500 | 79 |
| CSRF protection on OIDC login is brokenAnalysed#1878381 | Valid | Nextcloud | Cross-Site Request Forgery | Medium | 2023-04-04 | $500 | 77 |
| Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using ChromeAnalysed#1113559 | Valid | Starbucks | Cross-Site Request Forgery | High | 2021-05-18 | – | 77 |
| CSRF on Periscope Web OAuth authorization endpointAnalysed#215381 | Valid | X / xAI | Cross-Site Request Forgery | – | 2017-07-26 | – | 74 |
| Changing paymentProfileUuid when booking a trip allows free ridesAnalysed#162809 | Valid | Uber | Cross-Site Request Forgery | – | 2016-09-15 | – | 73 |
| Facebook OAuth Code Theft through referer leakage on support.rockstargames.comAnalysed#482743 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2019-02-19 | – | 71 |
| CSRF to change password#204703 | No longer public | Nord Security | Cross-Site Request Forgery | – | 2022-01-12 | – | 71 |
| CSRF vulnerability allows disabling Gmail contacts link for user referralsAnalysed#1668489 | Valid | Insightly | Cross-Site Request Forgery | Medium | 2025-09-19 | – | 70 |
| CSRF leads to Account takeoverAnalysed#2712857 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2024-12-18 | – | 67 |
| csrftoken not unique to session or specific user and csrfmiddlewaretoken can be alteredAnalysed#2513333 | Valid | Mozilla | Cross-Site Request Forgery | Low | 2024-11-20 | $500 | 63 |
| [CRITICAL] Full account takeover using CSRFAnalysed#127703 | Valid | Bumble | Cross-Site Request Forgery | – | 2016-04-12 | – | 63 |
| Client-Side Path Traversal on LINE Developers ConsoleAnalysed#2473862 | Valid | LY Corporation | Cross-Site Request Forgery | Medium | 2024-09-26 | – | 61 |
| CSRF to delete a pet on ██████Analysed#2261600 | Valid | Mars | Cross-Site Request Forgery | Low | 2024-02-05 | – | 61 |
| Revocation API Token by Bypassing The XSRF TokenAnalysed#2312217 | Valid | Enjin | Cross-Site Request Forgery | Critical | 2024-01-19 | – | 60 |
| [Admin Panel] CSRF to resume/pause runnerAnalysed#415238 | Valid | GitLab | Cross-Site Request Forgery | Low | 2020-12-01 | – | 60 |
| CSRF at Network featureAnalysed#3230359 | Valid | Lichess | Cross-Site Request Forgery | Medium | 2025-07-08 | – | 59 |
| CSRF Trial 14 days express subscriptionAnalysed#334139 | Valid | Instacart | Cross-Site Request Forgery | – | 2019-02-27 | – | 59 |
| Periscope iOS app CSRF in follow action due to deeplinkAnalysed#805073 | Valid | X / xAI | Cross-Site Request Forgery | Low | 2020-03-31 | $2,940 | 58 |
| CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)Analysed#260697 | Valid | Discourse | Cross-Site Request Forgery | Low | 2018-08-08 | – | 58 |
| [tanks.mail.ru] SSRF + Кража cookie#1166943 | No longer public | Mail.ru | Cross-Site Request Forgery | – | 2021-07-22 | $750 | 55 |
| Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137 | Duplicate | Ubiquiti Inc. | Cross-Site Request Forgery | High | 2016-11-29 | – | 55 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.