Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Account Takeover using Linked Accounts due to lack of CSRF protectionAnalysed#463330	Valid	Cross-Site Request Forgery	High	2019-02-20	–	238
SocialClub Account Take Over Through Import Friends featureAnalysed#901728	Valid	Cross-Site Request Forgery	High	2021-04-01	–	116
Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.Analysed#787160	Valid	Cross-Site Request Forgery	Medium	2020-06-24	–	112
CSRF Vulnerability on https://signin.rockstargames.com/tpa/facebook/link/Analysed#474833	Valid	Cross-Site Request Forgery	Medium	2020-06-12	–	104
Facebook OAuth Code Theft through referer leakage on support.rockstargames.comAnalysed#482743	Valid	Cross-Site Request Forgery	Medium	2019-02-19	–	71
CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'Analysed#152013	Valid	Cross-Site Request Forgery	Medium	2017-03-10	–	40
<- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->Analysed#204292	Valid	Cross-Site Request Forgery	Critical	2017-05-24	–	39
Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/articleAnalysed#790465	Valid	Cross-Site Request Forgery	Medium	2020-06-24	–	29
CSRF Vulnerability on post creation page /community/create-post.jsonAnalysed#487378	Valid	Cross-Site Request Forgery	Low	2020-07-07	–	29
CSRF Vulnerability allows attackers to steal SocialClub private token.Analysed#253128	Valid	Cross-Site Request Forgery	High	2017-08-03	–	28
SocialClub's Facebook OAuth Theft through Warehouse XSS.Analysed#316948	Valid	Cross-Site Request Forgery	Medium	2018-04-23	–	17
csrf in https://www.rockstargames.com/reddeadonline/feedback/submit.jsonAnalysed#796295	Valid	Cross-Site Request Forgery	Low	2020-07-07	–	14
Image Injection vulnerability in www.rockstargames.com/IV/screens/1280x720Image.htmlAnalysed#784101	Valid	Cross-Site Request Forgery	Medium	2020-06-24	–	14
Found CSRF Vulnerability in https://support.rockstargames.com/#423602	Valid	Cross-Site Request Forgery	Low	2018-10-16	$150	11
Referer Leakge in language changer may lead to FB token theft.#809691	Valid	Cross-Site Request Forgery	Medium	2020-06-24	–	10
CSRF Vulnerabiliy on Facebook Linkage Page Allows Full Account takerover of Socialclub Accounts.#653254	Valid	Cross-Site Request Forgery	High	2020-06-24	–	6

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.