Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779 | Valid | Denial of Service | – | 2019-04-25 | – | 323 |
| url that twitter mobile site can not loadAnalysed#500686 | Valid | Denial of Service | Low | 2019-03-19 | $1,120 | 142 |
| character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorAnalysed#819088 | Valid | Denial of Service | Medium | 2020-05-06 | – | 141 |
| Denial of Service | twitter.com & mobile.twitter.comAnalysed#903740 | Valid | Denial of Service | Medium | 2020-09-02 | $1,120 | 89 |
| Denial of Service [Chrome]Analysed#921286 | Valid | Denial of Service | Medium | 2020-07-24 | $560 | 66 |
| DOM based cookie bombAnalysed#57356 | Valid | Denial of Service | – | 2017-04-11 | – | 55 |
| cookie injection allow dos attack to periscope.tvAnalysed#583819 | Valid | Denial of Service | Medium | 2019-07-03 | $560 | 26 |
| lack of input validation that can lead Denial of Service (DOS)Analysed#768677 | Valid | Denial of Service | Medium | 2020-03-12 | $560 | 22 |
| iOS app crashed by specially crafted direct message reactions#784676 | Valid | Denial of Service | Medium | 2020-02-21 | $560 | 17 |
| User input validation can lead to DOS#767458 | Valid | Denial of Service | Medium | 2020-03-26 | $560 | 13 |
| Password reset link not validated.#22012 | Informative | Denial of Service | – | 2014-08-31 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.