Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200	Valid	Cross-site Scripting	–	2018-11-06	–	100
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835	Valid	Cross-site Scripting	–	2020-05-19	–	137
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443	Valid	Open Redirect	–	2019-02-07	–	188
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147	Valid	Injection and Smuggling	–	2019-08-07	$18,900	685
DoS on PayPal via web cache poisoningAnalysed#622122	Valid	Denial of Service	–	2019-10-23	$9,700	851
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585	Valid	Command and Code Injection	–	2021-02-09	$30,000	946
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737	Valid	Authentication	–	2020-01-08	$15,300	1,409
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152	Valid	Injection and Smuggling	–	2019-08-07	$20,000	2,687

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.