Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | Cross-Site Request Forgery | Low | 2020-02-21 | $1,540 | 224 |
| [CRITICAL] Full account takeover using CSRFAnalysed#235642 | Valid | Cross-Site Request Forgery | High | 2017-11-03 | – | 88 |
| CSRF on Periscope Web OAuth authorization endpointAnalysed#215381 | Valid | Cross-Site Request Forgery | – | 2017-07-26 | – | 74 |
| Periscope iOS app CSRF in follow action due to deeplinkAnalysed#805073 | Valid | Cross-Site Request Forgery | Low | 2020-03-31 | $2,940 | 58 |
| CSRF on cards APIAnalysed#95555 | Valid | Cross-Site Request Forgery | – | 2017-04-11 | – | 41 |
| CSRF on https://www.niche.co leads to "account disconnection"#493552 | Duplicate | Cross-Site Request Forgery | Medium | 2019-03-02 | – | 35 |
| CSRF and probable account takeover on https://www.niche.co#493535 | Valid | Cross-Site Request Forgery | Medium | 2019-02-28 | – | 24 |
| login csrf in analytics.mopub.com#577920 | Valid | Cross-Site Request Forgery | Medium | 2019-10-02 | $280 | 12 |
| Add tweet to collection CSRF#100820 | Valid | Cross-Site Request Forgery | – | 2016-08-22 | – | 12 |
| CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)#115158 | Valid | Cross-Site Request Forgery | – | 2017-11-06 | – | 8 |
| URGENT : NICHE.co Account Take Over Vulnerability#100849 | Valid | Cross-Site Request Forgery | – | 2015-12-21 | $560 | 7 |
| [mobile.twitter.com / twitter.com] CSRF protection bypass#14883 | Valid | Cross-Site Request Forgery | – | 2015-05-04 | – | 6 |
| Notifications can mark as read by CSRF#36980 | Informative | Cross-Site Request Forgery | – | 2015-01-03 | – | 4 |
| iOS App can establish Facetime calls without user's permission#28500 | Valid | Cross-Site Request Forgery | – | 2015-04-27 | – | 4 |
| CSRF in crashlytics.com#13856 | Valid | Cross-Site Request Forgery | – | 2014-09-08 | – | 1 |
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.