Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/Analysed#386735 | Valid | Cryptography | Low | 2018-09-20 | – | 15 |
| No rate limit in stats api token endpointAnalysed#412526 | Valid | Authentication | Low | 2018-10-19 | – | 15 |
| Form Replay in customer information formAnalysed#411620 | Valid | Authentication | Medium | 2019-01-11 | – | 16 |
| Open redirect on chaturbate.com (tipping/purchase_success)Analysed#413426 | Valid | Open Redirect | Low | 2018-10-25 | $250 | 26 |
| View Failed Approval and Pending videos other usersAnalysed#411679 | Valid | No weakness recorded | Low | 2018-10-21 | $200 | 28 |
| CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSSAnalysed#386334 | Valid | Cross-site Scripting | High | 2018-09-19 | – | 43 |
| Open redirection at https://chaturbate.com/auth/login/Analysed#411723 | Valid | Open Redirect | Low | 2018-10-22 | – | 55 |
| Reflected XSS on secure.chaturbate.comAnalysed#413412 | Valid | Cross-site Scripting | High | 2018-10-18 | $800 | 69 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.