External URL page bypass #63158 Valid No weakness recorded – 2015-05-28 – 3 Hackerone impersonation #97377 Valid No weakness recorded – 2015-12-02 – 3 Reverse Tabnabbing Vulnerability in Outgoing Links #284143 Informative No weakness recorded Medium 2017-11-21 – 3 Window Opener Property Bug #27987 Valid No weakness recorded – 2014-10-28 – 4 Content spoofing on invitations page #92607 Valid No weakness recorded – 2015-10-21 – 4 No option to logout concurrent sessions #20122 Informative No weakness recorded – 2014-07-17 – 5 harvesting attack on user registration #2193 Informative No weakness recorded – 2014-05-19 – 6 creating titleless and non-closable bugs #6350 Valid No weakness recorded – 2014-04-17 – 6 Markdown code block sequence makes report unreadable #46952 Valid No weakness recorded – 2015-06-29 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 New hacktivity view discloses report IDs of non-public reports #127235 Valid No weakness recorded – 2016-04-26 – 6 In markdown, parsing things like @danlec and #46072 after links is unsafe #46312 Valid No weakness recorded – 2015-07-04 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7 Weird Bug - Ability to see partial of other user's notification #2584 Valid No weakness recorded – 2014-04-19 – 8 Email changing #18846 Informative No weakness recorded – 2014-08-28 – 8 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Flawed account creation process allows registration of usernames corresponding to existing file names #477 Valid No weakness recorded – 2014-04-19 $100 11 Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13 Session Management #288 Valid No weakness recorded – 2014-04-19 – 14 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk #100509 Valid No weakness recorded – 2015-12-02 $1,000 15 Report title and issue information prepopulated #111868 N/A No weakness recorded – 2016-07-15 – 15 Flawed account creation process allows registration of usernames corresponding to existing file names #275 Valid No weakness recorded – 2015-06-08 – 16 HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com #97292 Valid No weakness recorded – 2015-12-02 – 18 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578 #112935 Valid No weakness recorded – 2016-02-24 – 18 DNS Misconfiguration #1509 Valid No weakness recorded – 2014-02-15 – 19 Corrupted Authorization header can cause logs not to be ingested properly in ████████ #447488 Valid No weakness recorded Medium 2019-04-04 – 19 Session hijacking attack #163381 N/A No weakness recorded – 2019-12-06 – 21 Session not expired on logout Analysed #353 Valid No weakness recorded – 2014-04-19 $100 22 Login page password-guessing attack #110 Informative No weakness recorded – 2014-01-16 – 23 Non-secure requests are not automatically upgraded to HTTPS Analysed #158186 Valid No weakness recorded – 2016-08-19 – 30 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Accidental Access to Programs Information via SAML Login Analysed #438306 Valid No weakness recorded Critical 2018-11-14 – 34 DNS Cache Poisoning Analysed #487 Valid No weakness recorded – 2014-01-09 $100 41 Path traversal leading to limited CSRF on GET requests on two endpoints Analysed #301862 Valid No weakness recorded – 2019-04-05 – 41 HackerOne support disclosing report state without checking user identity Analysed #356566 Valid No weakness recorded Low 2018-06-02 $500 43 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 Disclosing a private program in an external link if program is paused Analysed #418474 Valid No weakness recorded Low 2019-06-28 $500 44 "Bounty splitting enabled" can discloses if public VDPs are running private VRP Analysed #1103812 Valid No weakness recorded Low 2021-03-18 – 46 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 Real impersonation Analysed #280 Valid No weakness recorded – 2013-11-30 – 48 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint Analysed #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission Analysed #1039821 Valid No weakness recorded Low 2021-06-18 – 64 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65 The hacker has access to the administrative part of the management reports in publish report Analysed #867249 Valid No weakness recorded Low 2020-12-16 $500 71 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72 Near to Infinite loop when changing Group's name that has API token as Team Member Analysed #880187 Valid No weakness recorded Medium 2020-07-23 $2,500 77 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92