Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Make API calls on behalf of another user (CSRF protection bypass)Analysed#44146 | Valid | Cross-Site Request Forgery | – | 2015-01-22 | – | 33 |
| OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingAnalysed#136582 | Valid | Cross-Site Request Forgery | – | 2017-10-18 | – | 32 |
| CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public#136481 | Valid | Cross-Site Request Forgery | – | 2016-07-29 | – | 15 |
| URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io#49663 | Valid | Cross-Site Request Forgery | – | 2015-04-18 | – | 14 |
| CSRF bypass#45428 | Informative | Cross-Site Request Forgery | – | 2015-01-30 | – | 4 |
| [URGENT ISSUE] Add or Delete the videos in watch later list of any user .#52982 | Valid | Cross-Site Request Forgery | – | 2015-05-01 | – | 2 |
| No Limitation on Following allows user to follow people automatically!#43846 | Valid | Cross-Site Request Forgery | – | 2016-05-02 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.