Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using ChromeAnalysed#1113559	Valid	Cross-Site Request Forgery	High	2021-05-18	–	77
Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xmlAnalysed#244504	Valid	Cross-Site Request Forgery	High	2017-09-23	–	29
Norway - store.starbucks.no - CSRF on email changeAnalysed#718852	Valid	Cross-Site Request Forgery	High	2020-01-23	–	27
Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sitesAnalysed#206319	Valid	Cross-Site Request Forgery	High	2017-05-15	–	22
CSRF: add item to victim's cart automatically (starbucks.com - updatecart)Analysed#177472	Valid	Cross-Site Request Forgery	Medium	2017-06-02	–	13
Missing CSRF Token On Remove Coupun From Cart#227726	Duplicate	Cross-Site Request Forgery	Low	2019-02-08	–	10
CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard)#177635	Valid	Cross-Site Request Forgery	Low	2017-05-15	–	10
CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card#233099	Valid	Cross-Site Request Forgery	Medium	2017-09-25	–	9
Missing CSRF Token On Add Coupon To Basket#227725	Duplicate	Cross-Site Request Forgery	Low	2019-01-22	–	8
CSRF exploit \| Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments)#177639	Valid	Cross-Site Request Forgery	Medium	2017-02-13	–	8
csrf blogs.starbucks.com#198470	Duplicate	Cross-Site Request Forgery	None	2017-08-15	–	5

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.