Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Able to approve admin approval and change effective status without adding payment details .Analysed#1543159	Valid	Input Validation and Logic	High	2022-06-22	$5,000	191
s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shAnalysed#1285598	Valid	Input Validation and Logic	High	2021-10-21	–	96
IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameterAnalysed#1213765	Valid	Input Validation and Logic	Medium	2021-10-21	$500	42
Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`#1543770	Valid	Input Validation and Logic	Low	2022-07-04	$100	19
Email Verification Bypass And Get access to user's private invitation.#1350401	N/A	Input Validation and Logic	Medium	2021-10-21	–	3
com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)#1325649	Duplicate	Input Validation and Logic	Medium	2021-12-13	–	2
Content Spoofing/Text Injection at https://gateway-production.dubsmash.com#1166770	N/A	Input Validation and Logic	None	2021-10-27	–	1
Content Spoofing#1165919	N/A	Input Validation and Logic	Low	2021-10-21	–	1

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.