Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io#1028345	Valid	Open Redirect	–	2021-03-26	–	54
Open Redirection in index.php page#320376	Valid	Open Redirect	–	2018-03-07	–	53
New link opening method makes hackerone vulnerable to tabnabbing#1159398	Valid	Open Redirect	–	2021-07-07	–	51
Websites opened from reports can change url of report page#189726	Valid	Open Redirect	–	2017-02-25	–	50
Domain spoofing in redirect page using RTLO#299403	Valid	Open Redirect	–	2018-01-30	–	48
Open redirect vulnerability in index.php#439075	Valid	Open Redirect	–	2019-02-03	–	39
Open Redirection in [https://www.hackerone.com/index.php]#562417	Valid	Open Redirect	–	2019-05-08	–	33
Attachment references in markdown don't warn before downloading#1386277	Valid	Open Redirect	Low	2022-02-25	–	29
Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session#111968	Valid	Open Redirect	–	2016-02-24	–	28
Tab nabbing in Hackerone inbox.#1145563	Valid	Open Redirect	–	2021-08-09	$500	23
Limited Open redirection using SSO-SAML#178345	Valid	Open Redirect	–	2017-03-26	–	19
Bypassing the External Link Warning#1139520	Valid	Open Redirect	–	2021-05-07	–	14
Open redirect in "Language change".#52035	Valid	Open Redirect	–	2015-06-19	$500	12
External links should use rel="noopener" or use the redirect service#124620	Valid	Open Redirect	–	2016-04-05	–	8
Redirect while opening links in new tabs#23386	Valid	Open Redirect	–	2014-09-12	$500	8
Open redirect deceive in hackerone.com via another open redirect link.#296706	Informative	Open Redirect	–	2017-12-13	–	7
"learn more here", reward email - domain expired.#52532	Valid	Open Redirect	–	2015-03-23	–	7
Cross-domain AJAX request#97948	Valid	Open Redirect	–	2015-11-14	–	6
Open-redirect on hackerone.com#57163	Valid	Open Redirect	–	2015-04-23	–	6
Redirect FILTER bypass in report/comment#28865	Valid	Open Redirect	–	2014-10-19	$500	6
Homograph Attack#59372	Valid	Open Redirect	–	2015-05-09	–	5

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.