Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.ioAnalysed#49663 | Valid | Vimeo | Cross-Site Request Forgery | – | 2015-04-18 | – | 14 |
| Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.htmlAnalysed#784101 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2020-06-24 | – | 14 |
| csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.jsonAnalysed#796295 | Valid | Rockstar Games | Cross-Site Request Forgery | Low | 2020-07-07 | – | 14 |
| CSRF to Stored HTML injection at https://www.█████Analysed#1014593 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2020-12-03 | – | 14 |
| CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicAnalysed#136481 | Valid | Vimeo | Cross-Site Request Forgery | – | 2016-07-29 | – | 15 |
| Posting to Twitter CSRF on php/post_twitter_authenticate.phpAnalysed#249234 | Valid | Eternal | Cross-Site Request Forgery | Low | 2017-08-19 | $50 | 15 |
| CSRF in https://███Analysed#1090838 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2021-04-20 | – | 15 |
| Отсутствие CSRF ключа на функции Закрытый Профиль.Analysed#448928 | Valid | ok.ru | Cross-Site Request Forgery | Critical | 2020-05-15 | – | 16 |
| CSRF for deleting videosAnalysed#998979 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2020-12-23 | – | 16 |
| Full account takeover using CSRF and password resetAnalysed#6910 | Valid | IRCCloud | Cross-Site Request Forgery | – | 2014-04-14 | – | 17 |
| CSRF Проверить является ли пользователь админом группы.Analysed#250386 | Valid | VK.com | Cross-Site Request Forgery | – | 2017-09-14 | $100 | 17 |
| SocialClub's Facebook OAuth Theft through Warehouse XSS.Analysed#316948 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2018-04-23 | – | 17 |
| Chained vulnerabilities create DOS attack against users on desafio5estrelas.comAnalysed#624645 | Valid | Uber | Cross-Site Request Forgery | Low | 2021-03-30 | $1,000 | 17 |
| Widespread CSRF on authenticated POST endpointsAnalysed#1309435 | Valid | UPchieve | Cross-Site Request Forgery | High | 2022-02-13 | – | 17 |
| CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953 | Valid | Lyst | Cross-Site Request Forgery | Medium | 2017-09-28 | $150 | 19 |
| CSRF in Raffles Ticket PurchasingAnalysed#272588 | Valid | Unikrn | Cross-Site Request Forgery | High | 2018-04-10 | – | 19 |
| CSRF Bypassed on Logout EndpointAnalysed#1091403 | Valid | Enjin | Cross-Site Request Forgery | Low | 2022-06-17 | – | 19 |
| [tumblr.com] CSRF in /svc/user/filtered_contentAnalysed#1010806 | Valid | Automattic | Cross-Site Request Forgery | Low | 2020-12-26 | – | 20 |
| CSRF in zone‑include.php allows unauthorized banner and campaign linkingAnalysed#3781691 | Valid | Revive Adserver | Cross-Site Request Forgery | Medium | 2026-06-25 | – | 20 |
| Log in a user to another accountAnalysed#774 | Valid | Phabricator | Cross-Site Request Forgery | – | 2014-02-22 | $300 | 21 |
| Arbitrary change of blog's background image via CSRFAnalysed#881855 | Valid | WordPress | Cross-Site Request Forgery | Medium | 2020-12-14 | – | 21 |
| CSRF when unlocking lenses leads to lenses being forcefully installed without user interactionAnalysed#1085336 | Valid | Snapchat | Cross-Site Request Forgery | Low | 2021-07-29 | $250 | 21 |
| CSRF in github integrationAnalysed#174328 | Valid | Slack | Cross-Site Request Forgery | Medium | 2016-11-18 | $500 | 22 |
| Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sitesAnalysed#206319 | Valid | Starbucks | Cross-Site Request Forgery | High | 2017-05-15 | – | 22 |
| CSRF Attack leads to delete album at ████████Analysed#2697588 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 22 |
| Comment/channel unsubscribe GET CSRFAnalysed#1096141 | Valid | ExpressionEngine | Cross-Site Request Forgery | Low | 2024-05-28 | – | 23 |
| CSRF and probable account takeover on https://www.niche.coAnalysed#493535 | Valid | X / xAI | Cross-Site Request Forgery | Medium | 2019-02-28 | – | 24 |
| CSRF in changing password after using reset password linkAnalysed#1086752 | Valid | OpenMage | Cross-Site Request Forgery | Low | 2021-05-27 | – | 24 |
| Cross-Site Request Forgery (CSRF) to xssAnalysed#1183241 | Valid | MTN Group | Cross-Site Request Forgery | Medium | 2022-10-30 | – | 25 |
| CSRF to delete a petAnalysed#2029753 | Valid | Mars | Cross-Site Request Forgery | Medium | 2023-08-30 | – | 25 |
| [www.drive2.ru] CSRF through FCTX token bypassAnalysed#835142 | Valid | DRIVE.NET, Inc. | Cross-Site Request Forgery | Medium | 2020-03-31 | – | 26 |
| Switching the user to the attacker's accountAnalysed#727 | Valid | HackerOne | Cross-Site Request Forgery | – | 2014-02-20 | $150 | 27 |
| Norway - store.starbucks.no - CSRF on email changeAnalysed#718852 | Valid | Starbucks | Cross-Site Request Forgery | High | 2020-01-23 | – | 27 |
| [socket.io] Cross-Site Websocket HijackingAnalysed#931197 | Valid | Node.js third-party modules | Cross-Site Request Forgery | High | 2021-01-31 | – | 27 |
| Drive-by arbitrary file deletion in the GDK via letter_opener_web gemAnalysed#1353103 | Valid | GitLab | Cross-Site Request Forgery | Medium | 2021-11-12 | $750 | 27 |
| CSRF Vulnerability allows attackers to steal SocialClub private token.Analysed#253128 | Valid | Rockstar Games | Cross-Site Request Forgery | High | 2017-08-03 | – | 28 |
| Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xmlAnalysed#244504 | Valid | Starbucks | Cross-Site Request Forgery | High | 2017-09-23 | – | 29 |
| Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilitiesAnalysed#323899 | Valid | Uber | Cross-Site Request Forgery | Medium | 2021-02-25 | $500 | 29 |
| CSRF Vulnerability on post creation page /community/create-post.jsonAnalysed#487378 | Valid | Rockstar Games | Cross-Site Request Forgery | Low | 2020-07-07 | – | 29 |
| CSRF resulting in adding pet at ███████Analysed#2313478 | Valid | Mars | Cross-Site Request Forgery | Low | 2024-06-25 | – | 29 |
| Site-wide CSRF on eats.uber.comAnalysed#161529 | Valid | Uber | Cross-Site Request Forgery | High | 2018-12-19 | – | 30 |
| TikTok Session Donation CSRF via QR code loginAnalysed#1133661 | Valid | TikTok | Cross-Site Request Forgery | Low | 2021-06-17 | – | 30 |
| OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingAnalysed#136582 | Valid | Vimeo | Cross-Site Request Forgery | – | 2017-10-18 | – | 32 |
| CSRF in Delete Pet FunctionAnalysed#2445106 | Valid | Mars | Cross-Site Request Forgery | Medium | 2024-11-19 | – | 32 |
| Make API calls on behalf of another user (CSRF protection bypass)Analysed#44146 | Valid | Vimeo | Cross-Site Request Forgery | – | 2015-01-22 | – | 33 |
| JSON CSRF on POST Heartbeats APIAnalysed#245346 | Valid | WakaTime | Cross-Site Request Forgery | Medium | 2017-07-03 | – | 34 |
| monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)Analysed#1466765 | Valid | Kubernetes | Cross-Site Request Forgery | Low | 2024-06-25 | $100 | 36 |
| (BYPASS) Open redirect and XSS in supporthiring.shopify.comAnalysed#158434 | Valid | Shopify | Cross-Site Request Forgery | – | 2016-11-21 | – | 37 |
| CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'Analysed#152013 | Valid | Rockstar Games | Cross-Site Request Forgery | Medium | 2017-03-10 | – | 40 |
| CSRF on cards APIAnalysed#95555 | Valid | X / xAI | Cross-Site Request Forgery | – | 2017-04-11 | – | 41 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.