Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717 | Valid | Authentication | – | 2016-07-14 | – | 312 |
| RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014 | Valid | Command and Code Injection | – | 2021-02-24 | $9,000 | 325 |
| Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781 | Valid | Authentication | – | 2019-01-25 | – | 427 |
| [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813 | Valid | Information Disclosure | – | 2021-02-25 | $40,000 | 458 |
| Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340 | Valid | Information Disclosure | – | 2019-09-09 | – | 643 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.