WannaCrypt “Killswitch” Analysed #228648 Valid No weakness recorded – 2017-05-13 – 809 June 2022 Incident Report Analysed #1622449 Valid No weakness recorded Critical 2022-07-01 – 426 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded High 2022-04-18 – 318 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}` Analysed #1618347 Valid No weakness recorded Critical 2025-01-21 $25,000 295 HackerOne making payments in USDC (Coinbase stable coin) Analysed #1220747 Valid No weakness recorded None 2021-06-17 – 201 2020-10-09 Credential Stuffing Attack Analysed #1007689 Valid No weakness recorded – 2020-10-13 – 196 DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API Analysed #3287208 Valid No weakness recorded – 2026-04-16 – 185 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded Medium 2021-08-24 $2,500 130 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded Low 2019-09-09 $500 104 How the Arch Angel stole Live Events Analysed #2285198 Valid No weakness recorded None 2023-12-15 – 98 Subdomain takeover of resources.hackerone.com Analysed #863551 Valid No weakness recorded Low 2020-05-15 $500 95 `exportReportPdf` mutation shows internal Activity Analysed #3577216 Valid No weakness recorded High 2026-07-29 – 92 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 Near to Infinite loop when changing Group's name that has API token as Team Member Analysed #880187 Valid No weakness recorded Medium 2020-07-23 $2,500 77 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72 The hacker has access to the administrative part of the management reports in publish report Analysed #867249 Valid No weakness recorded Low 2020-12-16 $500 71 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65 Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission Analysed #1039821 Valid No weakness recorded Low 2021-06-18 – 64 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint Analysed #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 Real impersonation Analysed #280 Valid No weakness recorded – 2013-11-30 – 48 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 "Bounty splitting enabled" can discloses if public VDPs are running private VRP Analysed #1103812 Valid No weakness recorded Low 2021-03-18 – 46 Disclosing a private program in an external link if program is paused Analysed #418474 Valid No weakness recorded Low 2019-06-28 $500 44 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 HackerOne support disclosing report state without checking user identity Analysed #356566 Valid No weakness recorded Low 2018-06-02 $500 43 Path traversal leading to limited CSRF on GET requests on two endpoints Analysed #301862 Valid No weakness recorded – 2019-04-05 – 41 DNS Cache Poisoning Analysed #487 Valid No weakness recorded – 2014-01-09 $100 41 Accidental Access to Programs Information via SAML Login Analysed #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Non-secure requests are not automatically upgraded to HTTPS Analysed #158186 Valid No weakness recorded – 2016-08-19 – 30 Login page password-guessing attack #110 Informative No weakness recorded – 2014-01-16 – 23 Session not expired on logout Analysed #353 Valid No weakness recorded – 2014-04-19 $100 22 Session hijacking attack #163381 N/A No weakness recorded – 2019-12-06 – 21 Corrupted Authorization header can cause logs not to be ingested properly in ████████ Analysed #447488 Valid No weakness recorded Medium 2019-04-04 – 19 DNS Misconfiguration Analysed #1509 Valid No weakness recorded – 2014-02-15 – 19 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578 #112935 Valid No weakness recorded – 2016-02-24 – 18 HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com #97292 Valid No weakness recorded – 2015-12-02 – 18 Flawed account creation process allows registration of usernames corresponding to existing file names #275 Valid No weakness recorded – 2015-06-08 – 16 Report title and issue information prepopulated #111868 N/A No weakness recorded – 2016-07-15 – 15 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk #100509 Valid No weakness recorded – 2015-12-02 $1,000 15 Session Management #288 Valid No weakness recorded – 2014-04-19 – 14 Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13 Flawed account creation process allows registration of usernames corresponding to existing file names #477 Valid No weakness recorded – 2014-04-19 $100 11 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Email changing #18846 Informative No weakness recorded – 2014-08-28 – 8 Weird Bug - Ability to see partial of other user's notification #2584 Valid No weakness recorded – 2014-04-19 – 8 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7