Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
XSS and Open Redirect on MoPub LoginAnalysed#683298	Valid	Open Redirect	–	2019-09-24	$1,540	248
Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comAnalysed#1073565	Valid	Open Redirect	Low	2021-05-04	–	53
Bypassing callback_url validation on DigitsAnalysed#108113	Valid	Open Redirect	–	2016-08-12	–	48
Open RedirectAnalysed#246897	Valid	Open Redirect	–	2017-08-19	–	41
Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domainAnalysed#635597	Valid	Open Redirect	Low	2019-08-26	$560	37
Accepting error message on twitter sends you to attacker siteAnalysed#781673	Valid	Open Redirect	Medium	2020-03-13	$560	33
Open Redirect Protection BypassAnalysed#283460	Valid	Open Redirect	–	2017-12-23	–	24
Open Redirect leak of authenticity_token lead to full account take over.#49759	Valid	Open Redirect	–	2015-04-03	$1,400	7
Reporting user's profile by using another people's ID#47888	Valid	Open Redirect	–	2015-06-11	$140	4
Open redirection in fabric.io#39631	Valid	Open Redirect	–	2014-12-18	$280	3
Following a User Actually Follows Another User#95243	Valid	Open Redirect	–	2015-12-02	$280	1
open redirect sends authenticity_token to any website or (ip address)#50752	Valid	Open Redirect	–	2015-03-14	$560	1
Bad extended ascii handling in HTTP 301 redirects of t.co#34084	Valid	Open Redirect	–	2015-08-09	–	1

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.