Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Reset password cookie leads to account takeoverAnalysed#1004536	Valid	Input Validation and Logic	Medium	2020-10-12	–	41
Race Condition allows to get more free trials and get more than 100 languages and strings for freeAnalysed#1087188	Valid	Input Validation and Logic	Low	2021-02-25	–	20
No rate limiting for Remove Account lead to huge Mass mailings#1723445	Valid	Input Validation and Logic	None	2022-11-20	–	13
no notification send to victim if attacker hacks/accesses his victims WebLate account.#282772	Valid	Input Validation and Logic	Low	2018-09-26	–	11
Reset password more than once with a reset link #2#245450	Valid	Input Validation and Logic	–	2017-10-07	–	8
Running 2 accounts with a single email #3#245304	Valid	Input Validation and Logic	–	2018-08-27	–	8
Reset password more than once with a reset link#243594	Valid	Input Validation and Logic	–	2017-08-21	–	8
Running 2 accounts with a single email [Part 2]#241608	Valid	Input Validation and Logic	–	2017-10-07	–	7
Running 2 accounts with a single email#224072	Valid	Input Validation and Logic	None	2017-05-18	–	7
Persistence of Third Party Association.#241623	Valid	Input Validation and Logic	–	2017-08-21	–	6
No Rate Limit On Add new word#479021	Valid	Input Validation and Logic	Low	2019-01-14	–	5
The username of an account can be ..#243609	Valid	Input Validation and Logic	None	2017-07-27	–	5
Error Message When Changing Username#243664	Valid	Input Validation and Logic	None	2017-08-17	–	4

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.