Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| SVG parser loads external resources on image uploadAnalysed#97501 | Valid | Shopify | Cross-Site Request Forgery | – | 2016-06-02 | – | 15 |
| XSSI (Cross Site Script Inclusion)Analysed#118631 | Valid | Coinbase | Cross-Site Request Forgery | – | 2017-08-22 | – | 15 |
| Lack of CSRF protection on uberps.com makes every form vulnerable to CSRFAnalysed#343120 | Valid | Uber | Cross-Site Request Forgery | Medium | 2021-03-15 | $500 | 15 |
| csrf bypass using flash file + 307 redirect method at plugins endpointAnalysed#766205 | Valid | Stripo Inc | Cross-Site Request Forgery | Medium | 2020-02-10 | – | 15 |
| WooCommerce: Support Ticket indirect object referenceAnalysed#91599 | Valid | Automattic | Cross-Site Request Forgery | – | 2016-09-02 | – | 16 |
| CSRF logs the victim into attacker's accountAnalysed#339352 | Valid | Unikrn | Cross-Site Request Forgery | Medium | 2018-04-19 | – | 16 |
| CSRF to ATO at https://█████/user/account [HtUS]Analysed#1624421 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2023-01-06 | $500 | 16 |
| CSRF log victim into the attacker accountAnalysed#293016 | Valid | Unikrn | Cross-Site Request Forgery | High | 2018-04-10 | – | 17 |
| Twitter Disconnect CSRFAnalysed#111216 | Valid | Shopify | Cross-Site Request Forgery | – | 2016-02-01 | – | 18 |
| Possible CSRF during joining report as participantAnalysed#148517 | Valid | HackerOne | Cross-Site Request Forgery | – | 2016-07-12 | – | 18 |
| CSRF Add user templatesAnalysed#301919 | Valid | Mavenlink | Cross-Site Request Forgery | Medium | 2019-02-27 | – | 18 |
| CSRF to account takeover in https://███████.mil/Analysed#987751 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Critical | 2020-10-16 | – | 18 |
| URL Scheme misconfiguration on TikTok for IOSAnalysed#1437294 | Valid | TikTok | Cross-Site Request Forgery | Low | 2022-05-04 | $500 | 18 |
| Account TakeoverAnalysed#121827 | Valid | Bumble | Cross-Site Request Forgery | – | 2016-03-12 | – | 19 |
| CSRF allows to test email forwardingAnalysed#1131473 | Valid | HackerOne | Cross-Site Request Forgery | Low | 2021-05-13 | – | 19 |
| Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-authAnalysed#187520 | Valid | WordPress | Cross-Site Request Forgery | High | 2017-11-20 | – | 21 |
| CSRF - Close AccountAnalysed#856518 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2020-06-11 | – | 21 |
| UniFi Video Server web interface Configuration Restore CSRF leading to full application compromiseAnalysed#329749 | Valid | Ubiquiti Inc. | Cross-Site Request Forgery | High | 2019-04-28 | – | 22 |
| H1514 CSRF in Domain transfer allows adding your domain to other user's accountAnalysed#416978 | Valid | Shopify | Cross-Site Request Forgery | High | 2020-03-30 | – | 23 |
| Arbitrary forum topic close with GET CSRF.Analysed#1096128 | Valid | ExpressionEngine | Cross-Site Request Forgery | Low | 2024-05-28 | – | 23 |
| CSRF loginAnalysed#547 | Valid | HackerOne | Cross-Site Request Forgery | – | 2014-01-13 | – | 24 |
| Information disclosure (reset password token) and changing the user's passwordAnalysed#738 | Valid | HackerOne | Cross-Site Request Forgery | – | 2014-02-19 | $100 | 24 |
| CSRF Account Deletion on ███ WebsiteAnalysed#840285 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2020-07-09 | – | 24 |
| CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/triggerAnalysed#2294709 | Valid | Internet Bug Bounty | Cross-Site Request Forgery | Medium | 2024-01-09 | – | 24 |
| CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious linkAnalysed#1741430 | Valid | Nextcloud | Cross-Site Request Forgery | Medium | 2023-01-11 | – | 25 |
| CSRF in Importing CSV files [app.taxjar.com]Analysed#1637761 | Valid | Stripe | Cross-Site Request Forgery | Low | 2023-03-16 | – | 26 |
| 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .Analysed#1458236 | Valid | Aiven Ltd | Cross-Site Request Forgery | High | 2022-03-16 | – | 27 |
| Information leakage via CSV when content is valid JavaScriptAnalysed#207266 | Valid | HackerOne | Cross-Site Request Forgery | Low | 2017-05-23 | – | 29 |
| CSRF with logout actionAnalysed#1971589 | Valid | Weblate | Cross-Site Request Forgery | – | 2023-06-16 | – | 29 |
| CSRF in all API endpoints when authenticated using HTTP AuthenticationAnalysed#195156 | Valid | Shopify | Cross-Site Request Forgery | – | 2017-03-28 | – | 30 |
| [CSRF] No Csrf protection against sending invitation to join the team.Analysed#728199 | Valid | Lark Technologies | Cross-Site Request Forgery | Medium | 2022-10-20 | – | 30 |
| CSRF at https://chatstory.pixiv.net/importedAnalysed#534908 | Valid | pixiv | Cross-Site Request Forgery | Medium | 2020-07-02 | $500 | 31 |
| CSRF to XSSAnalysed#2736979 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 31 |
| Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]Analysed#251918 | Valid | Unikrn | Cross-Site Request Forgery | Medium | 2017-09-06 | – | 33 |
| Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)Analysed#975983 | Valid | CS Money | Cross-Site Request Forgery | Medium | 2020-10-27 | $300 | 33 |
| Account takeover through multistage CSRF at https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer and ../AutoChoice/changePwOktaAnswerAnalysed#1208453 | Valid | U.S. General Services Administration | Cross-Site Request Forgery | Medium | 2021-07-23 | – | 33 |
| CSRF Attack leads to delete album atAnalysed#2652190 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | Medium | 2024-12-18 | – | 33 |
| Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's hostAnalysed#263662 | Valid | GSA Bounty | Cross-Site Request Forgery | Medium | 2017-09-27 | – | 34 |
| [h1-2102] Wholesale - CSRF to Generate Invitation Token for a Customer and Move Customer to Invited StatusAnalysed#1091209 | Valid | Shopify | Cross-Site Request Forgery | Low | 2021-12-06 | – | 34 |
| Firmware download/install vulnerable to CSRFAnalysed#323852 | Valid | Ubiquiti Inc. | Cross-Site Request Forgery | High | 2020-05-29 | – | 35 |
| CSRF in AppSearch allows creation of "curations"Analysed#1477050 | Valid | Elastic | Cross-Site Request Forgery | Medium | 2022-11-17 | – | 35 |
| CSRF in Changing User Verification EmailAnalysed#1531235 | Valid | TikTok | Cross-Site Request Forgery | Low | 2022-09-13 | $500 | 37 |
| There is a POST based CSRF issue over IBM endpoint leading to modification of contact information.Analysed#2919623 | Valid | IBM | Cross-Site Request Forgery | Medium | 2025-02-04 | – | 38 |
| <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->Analysed#204292 | Valid | Rockstar Games | Cross-Site Request Forgery | Critical | 2017-05-24 | – | 39 |
| CSRF To Add New App In Developer Account And Bypassing Json FormatAnalysed#997615 | Valid | TikTok | Cross-Site Request Forgery | Medium | 2020-11-06 | $200 | 39 |
| CSRF to Information disclosure on password resetAnalysed#2106662 | Valid | Mozilla | Cross-Site Request Forgery | Low | 2023-11-27 | – | 39 |
| CSRF that makes any user send invitations to the attacker by simply clicking on a link.Analysed#1961163 | Valid | Cross-Site Request Forgery | Medium | 2023-12-06 | – | 41 | |
| Account takeover through CSRF in http://███████/██████████/default.aspAnalysed#670924 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2020-06-11 | – | 42 |
| CSRF on launchpad.37signals.com OAuth2 authorization endpointAnalysed#850022 | Valid | Basecamp | Cross-Site Request Forgery | High | 2020-10-30 | – | 44 |
| CSRF Attack on changing security questions leads to full Account TakeOverAnalysed#2652603 | Valid | U.S. Dept Of Defense | Cross-Site Request Forgery | High | 2024-12-18 | – | 47 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.