Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic Low 2020-10-15 – 322 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic Low 2019-04-05 – 154 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 Improper UUID validation results in bypass of #419896 Analysed #423073 Valid Input Validation and Logic High 2018-10-25 – 82 Asset Inventory Internal Descriptions are leaked in CSV export Analysed #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Residual Malicious Payloads on HackerOne after Vulnerability Fixes Analysed #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Minor security issue with Hackerone Invitations from sandbox program Analysed #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Program managers can see draft reports using Export Reports feature Analysed #1664920 Valid Input Validation and Logic Low 2023-05-18 – 50 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification Analysed #242964 Valid Input Validation and Logic Medium 2017-11-01 – 46 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Ability to invite a new member on Sandbox Program Analysed #1088966 Valid Input Validation and Logic Low 2021-04-05 – 44 User's who are banned from program can still be invited to the new reports as collaborators Analysed #1131306 Valid Input Validation and Logic Low 2021-09-22 – 37 Changing Victim's JIRA Integration Settings Through Multiple Bugs Analysed #226199 Valid Input Validation and Logic Medium 2017-05-23 $1,000 36 [Bypass] Ability to invite a new member in sandbox Organization Analysed #1486417 Valid Input Validation and Logic Medium 2022-04-14 – 35 Lack warning label when receiving a letter Analysed #1128701 Valid Input Validation and Logic Low 2021-05-13 – 33 A team member of the program with Report rights can ban the Admin Analysed #816143 Valid Input Validation and Logic Low 2020-05-15 – 30 Dangling cloud instance at vpn.inverselink.com Analysed #1112679 Valid Input Validation and Logic Low 2021-03-11 $500 29 Submitting report through Embedded Submission form gives user indefinite access to a profile Analysed #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee Analysed #808975 Valid Input Validation and Logic Low 2020-05-15 – 22 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic Low 2021-09-22 – 12 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic None 2018-12-12 – 12 Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic Low 2020-05-15 – 7