Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`Analysed#684092	Valid	BlockDev Sp. Z o.o	Input Validation and Logic	Critical	2019-10-01	–	466
Modify in-flight data to payment provider Smart2PayAnalysed#1295844	Valid	Valve	Input Validation and Logic	Critical	2021-08-10	$7,500	443
H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467	Valid	Shopify	Input Validation and Logic	Medium	2019-11-04	–	372
Bypass of GitLab CI runner slash fix in YAML validationAnalysed#409395	Valid	GitLab	Input Validation and Logic	Critical	2019-04-10	–	363
URL link spoofingAnalysed#481472	Valid	Slack	Input Validation and Logic	Low	2020-04-26	$250	362
Hackerone is not properly deleting user idAnalysed#1133118	Valid	HackerOne	Input Validation and Logic	Medium	2021-06-11	–	356
Double Payout via PayPalAnalysed#307239	Valid	Coinbase	Input Validation and Logic	Critical	2018-04-04	$10,000	324
Getting New Invitations without Leaving ProgramsAnalysed#999789	Valid	HackerOne	Input Validation and Logic	Low	2020-10-15	–	322
[fleet.city-mobil.ru] Driver balance increasing#751347	No longer public	Mail.ru	Input Validation and Logic	–	2020-04-15	–	319
Race Condition allows to redeem multiple times gift cards which leads to free "money"Analysed#759247	Valid	Reverb.com	Input Validation and Logic	High	2020-01-25	–	308
An attacker can run pipeline jobs as arbitrary userAnalysed#894569	Valid	GitLab	Input Validation and Logic	Critical	2020-08-26	$12,000	307
Ethereum account balance manipulationAnalysed#300748	Valid	Coinbase	Input Validation and Logic	Critical	2018-03-21	–	276
An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossAnalysed#771694	Valid	Semrush	Input Validation and Logic	High	2020-04-02	–	267
Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsAnalysed#1849626	Valid	Stripe	Input Validation and Logic	Medium	2023-02-25	$5,000	266
Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domainAnalysed#565883	Valid	GitLab	Input Validation and Logic	Medium	2019-08-30	–	249
Change phone number OTP flaw leads to any phone number takeoverAnalysed#2588329	Valid	inDrive	Input Validation and Logic	Critical	2024-10-09	$2,000	241
[www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)Analysed#511044	Valid	Eternal	Input Validation and Logic	Medium	2019-03-18	–	229
Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateAnalysed#1082847	Valid	Superhuman (formerly Grammarly)	Input Validation and Logic	Medium	2021-03-01	–	223
Github Account hijack through broken link in developer.twitter.comAnalysed#1031321	Valid	X / xAI	Input Validation and Logic	High	2021-02-04	–	222
ETH contract handling errorsAnalysed#328526	Valid	Coinbase	Input Validation and Logic	Critical	2018-04-04	–	208
Helpdesk Takeover at dmc.datastax.comAnalysed#759454	Valid	DataStax	Input Validation and Logic	High	2020-01-15	–	195
Able to approve admin approval and change effective status without adding payment details .Analysed#1543159	Valid	Reddit	Input Validation and Logic	High	2022-06-22	$5,000	191
Incorrect control of the trial period#865828	No longer public	Nord Security	Input Validation and Logic	–	2020-05-26	–	188
adding h1_analyst_* to username for normal usersAnalysed#1770797	Valid	HackerOne	Input Validation and Logic	Low	2023-04-12	$500	187
OLO Total price manipulation using negative quantitiesAnalysed#364843	Valid	Upserve	Input Validation and Logic	Critical	2019-07-06	–	167
Abusing "Report as abuse" functionality to delete any user's post.#411075	No longer public	Vanilla	Input Validation and Logic	–	2020-01-18	$300	160
2-factor authentication can be disabled when logged in without confirming account passwordAnalysed#783258	Valid	Localize	Input Validation and Logic	Medium	2020-02-10	–	159
Takeover of Twitter-owned domain at mobileapplinking.comAnalysed#321699	Valid	X / xAI	Input Validation and Logic	None	2019-02-28	–	159
Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comAnalysed#381356	Valid	HackerOne	Input Validation and Logic	Low	2019-04-05	–	154
Steal collateral during `end` process, by earning DSR interest after `flow`.Analysed#672664	Valid	BlockDev Sp. Z o.o	Input Validation and Logic	High	2019-09-09	–	152
Bypassing CORS Misconfiguration Leads to Sensitive ExposureAnalysed#768151	Valid	U.S. Dept Of Defense	Input Validation and Logic	Medium	2020-05-14	–	145
[blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure#747825	Informative	BlockDev Sp. Z o.o	Input Validation and Logic	–	2020-04-14	–	140
Bypassing HackerOne 2FA due to race conditionAnalysed#2598548	Valid	HackerOne	Input Validation and Logic	Medium	2024-10-30	–	139
worki.ru: SMS code bruteforce#700612	No longer public	Mail.ru	Input Validation and Logic	–	2019-11-15	$1,657	136
[api.zomato.com] Able to manipulate order amountAnalysed#512968	Valid	Eternal	Input Validation and Logic	High	2019-04-16	–	136
Business Logic Error – Bypass of OTP Verification During Signup on hover.comAnalysed#3255473	Valid	Tucows (VDP)	Input Validation and Logic	None	2025-09-02	–	135
Add upto 10K rupees to a wallet by paying an arbitrary amountAnalysed#1408782	Valid	Eternal	Input Validation and Logic	High	2022-02-23	$2,000	132
Able to manipulate order amount by removing cancellation amount and cause financial impactAnalysed#614523	Valid	Eternal	Input Validation and Logic	High	2019-08-16	–	130
Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsAnalysed#2295958	Valid	TikTok	Input Validation and Logic	Medium	2024-07-19	$1,000	129
Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520	Valid	pixiv	Input Validation and Logic	High	2026-04-27	$3,000	123
Any user could upload attachments to pentest scoping form they don't have access toAnalysed#2450215	Valid	HackerOne	Input Validation and Logic	High	2024-05-15	–	121
Account recovery text message is sending a wrong domain to users.Analysed#549364	Valid	HackerOne	Input Validation and Logic	Low	2019-05-31	–	117
@wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.Analysed#397792	Valid	HackerOne	Input Validation and Logic	Medium	2019-01-02	–	117
critical server misconfiguration lead to access to any user sensitive data which include user email and passwordAnalysed#1365738	Valid	Flickr	Input Validation and Logic	Medium	2021-11-02	$500	116
Availing Zomato gold by using a random third-party `wallet_id`Analysed#938021	Valid	Eternal	Input Validation and Logic	Critical	2020-08-07	$2,000	116
[help.steampowered.com] Account takeover bruteforcing SteamGuardAnalysed#407971	Valid	Valve	Input Validation and Logic	High	2019-01-23	$2,500	112
Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Analysed#2125049	Valid	inDrive	Input Validation and Logic	Medium	2024-07-02	–	110
Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Analysed#470749	Valid	X / xAI	Input Validation and Logic	Critical	2019-09-26	–	106
[stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information Exposure#910711	No longer public	Showmax	Input Validation and Logic	–	–	–	104
Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding featureAnalysed#334205	Valid	HackerOne	Input Validation and Logic	Medium	2018-04-18	$2,500	103

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.