Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.ioAnalysed#1028345 | Valid | Open Redirect | None | 2021-03-26 | – | 54 |
| Open Redirection in index.php pageAnalysed#320376 | Valid | Open Redirect | None | 2018-03-07 | – | 53 |
| New link opening method makes hackerone vulnerable to tabnabbingAnalysed#1159398 | Valid | Open Redirect | Low | 2021-07-07 | – | 51 |
| Websites opened from reports can change url of report pageAnalysed#189726 | Valid | Open Redirect | Medium | 2017-02-25 | – | 50 |
| Domain spoofing in redirect page using RTLOAnalysed#299403 | Valid | Open Redirect | Low | 2018-01-30 | – | 48 |
| Open redirect vulnerability in index.phpAnalysed#439075 | Valid | Open Redirect | None | 2019-02-03 | – | 39 |
| Open Redirection in [https://www.hackerone.com/index.php]Analysed#562417 | Valid | Open Redirect | None | 2019-05-08 | – | 33 |
| Attachment references in markdown don't warn before downloadingAnalysed#1386277 | Valid | Open Redirect | Low | 2022-02-25 | – | 29 |
| Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_sessionAnalysed#111968 | Valid | Open Redirect | – | 2016-02-24 | – | 28 |
| Tab nabbing in Hackerone inbox.Analysed#1145563 | Valid | Open Redirect | Low | 2021-08-09 | $500 | 23 |
| Limited Open redirection using SSO-SAMLAnalysed#178345 | Valid | Open Redirect | Low | 2017-03-26 | – | 19 |
| Bypassing the External Link WarningAnalysed#1139520 | Valid | Open Redirect | Low | 2021-05-07 | – | 14 |
| Open redirect in "Language change".#52035 | Valid | Open Redirect | – | 2015-06-19 | $500 | 12 |
| External links should use rel="noopener" or use the redirect service#124620 | Valid | Open Redirect | – | 2016-04-05 | – | 8 |
| Redirect while opening links in new tabs#23386 | Valid | Open Redirect | – | 2014-09-12 | $500 | 8 |
| "learn more here", reward email - domain expired.#52532 | Valid | Open Redirect | – | 2015-03-23 | – | 7 |
| Cross-domain AJAX request#97948 | Valid | Open Redirect | – | 2015-11-14 | – | 6 |
| Open-redirect on hackerone.com#57163 | Valid | Open Redirect | – | 2015-04-23 | – | 6 |
| Redirect FILTER bypass in report/comment#28865 | Valid | Open Redirect | – | 2014-10-19 | $500 | 6 |
| Homograph Attack#59372 | Valid | Open Redirect | – | 2015-05-09 | – | 5 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.