Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic – 2021-06-11 – 356 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic – 2020-10-15 – 322 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic – 2019-04-05 – 154 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Any user could upload attachments to pentest scoping form they don't have access to #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Account recovery text message is sending a wrong domain to users. #549364 Valid Input Validation and Logic – 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. #397792 Valid Input Validation and Logic – 2019-01-02 – 117 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature #334205 Valid Input Validation and Logic – 2018-04-18 $2,500 103 Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 Improper UUID validation results in bypass of #419896 #423073 Valid Input Validation and Logic – 2018-10-25 – 82 Asset Inventory Internal Descriptions are leaked in CSV export #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Residual Malicious Payloads on HackerOne after Vulnerability Fixes #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Minor security issue with Hackerone Invitations from sandbox program #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding #331691 Valid Input Validation and Logic – 2018-04-18 $500 54 Program managers can see draft reports using Export Reports feature #1664920 Valid Input Validation and Logic – 2023-05-18 – 50 Response program can display "eligible for bounty" in scope area in program policy #475660 Valid Input Validation and Logic – 2019-01-30 $500 47 Response program can create bounty table #460920 Valid Input Validation and Logic – 2019-01-07 $500 46 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification #242964 Valid Input Validation and Logic – 2017-11-01 – 46 API Last Request Date/Time Not Updating #220774 Valid Input Validation and Logic – 2019-05-19 – 45 Ability to invite a new member on Sandbox Program #1088966 Valid Input Validation and Logic – 2021-04-05 – 44 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 User's who are banned from program can still be invited to the new reports as collaborators #1131306 Valid Input Validation and Logic – 2021-09-22 – 37 Changing Victim's JIRA Integration Settings Through Multiple Bugs #226199 Valid Input Validation and Logic – 2017-05-23 $1,000 36 [Bypass] Ability to invite a new member in sandbox Organization #1486417 Valid Input Validation and Logic – 2022-04-14 – 35 Lack warning label when receiving a letter #1128701 Valid Input Validation and Logic – 2021-05-13 – 33 A team member of the program with Report rights can ban the Admin #816143 Valid Input Validation and Logic – 2020-05-15 – 30 Dangling cloud instance at vpn.inverselink.com #1112679 Valid Input Validation and Logic – 2021-03-11 $500 29 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic – 2021-09-20 – 29 Submitting report through Embedded Submission form gives user indefinite access to a profile #463828 Valid Input Validation and Logic – 2019-01-03 $500 29 2FA requirement bypass when claiming bounty #2528919 Informative Input Validation and Logic – 2024-07-11 – 22 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee #808975 Valid Input Validation and Logic – 2020-05-15 – 22 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic – 2021-09-22 – 12 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic – 2018-12-12 – 12 Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic – 2020-05-15 – 7