Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| OLO Total price manipulation using negative quantitiesAnalysed#364843 | Valid | Upserve | Input Validation and Logic | – | 2019-07-06 | – | 167 |
| Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneAnalysed#1727221 | Valid | HackerOne | Cross-Site Request Forgery | – | 2023-06-19 | – | 168 |
| Git flag injection leading to file overwrite and potential remote code executionAnalysed#653125 | Valid | GitLab | Command and Code Injection | – | 2019-12-19 | $3,500 | 169 |
| Stored-XSS with CSP-bypass via labels' colorAnalysed#1665658 | Valid | GitLab | Cross-site Scripting | – | 2023-02-19 | – | 169 |
| RCE of Burp Scanner / Crawler via ClickjackingAnalysed#1274695 | Valid | PortSwigger Web Security | Command and Code Injection | – | 2023-10-10 | $3,000 | 172 |
| User can delete data in shared folders he's not autorized to accessAnalysed#642515 | Valid | Nextcloud | Access Control | – | 2020-04-10 | – | 173 |
| [Portal 2] Remote Code Execution via voice packetsAnalysed#733267 | Valid | Valve | Memory Corruption | – | 2021-05-10 | $5,000 | 173 |
| GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionAnalysed#898528 | Valid | Shopify | No weakness recorded | – | 2020-07-16 | – | 173 |
| 1 click Account takeover via deeplink in [com.kayak.android]Analysed#1667998 | Valid | KAYAK | Access Control | – | 2023-01-19 | – | 173 |
| Mozilla VPN Clients: RCE via file write and path traversalAnalysed#2995025 | Valid | Mozilla | File and Path Handling | High | 2025-07-29 | $6,000 | 173 |
| Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlAnalysed#3694007 | Valid | HackerOne | Command and Code Injection | High | 2026-06-17 | $7,000 | 174 |
| Path traversal in filename in LINE Mac clientAnalysed#727727 | Valid | LY Corporation | File and Path Handling | – | 2020-07-31 | – | 175 |
| Previously created sessions continue being valid after MFA activationAnalysed#667739 | Valid | Superhuman (formerly Grammarly) | Access Control | – | 2019-08-19 | – | 176 |
| Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279 | Valid | PortSwigger Web Security | File and Path Handling | High | 2026-06-14 | $5,000 | 176 |
| IDOR leads to Edit Anyone's Blogs / WebsitesAnalysed#974222 | Valid | Automattic | Insecure Direct Object Reference | – | 2020-11-18 | – | 177 |
| protected Tweet settings overwritten by other settingsAnalysed#664038 | Valid | X / xAI | No weakness recorded | – | 2020-01-01 | – | 178 |
| Worker container escape lead to arbitrary file reading in host machine [again]Analysed#697055 | Valid | Semmle | Access Control | – | 2019-10-21 | $2,000 | 178 |
| IDOR Vulnerability at AddTagToAssets operation nameAnalysed#2633771 | Valid | HackerOne | Insecure Direct Object Reference | Medium | 2025-06-08 | – | 178 |
| Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.comAnalysed#1457471 | Valid | Shopify | Access Control | Medium | 2025-03-20 | – | 181 |
| DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIAnalysed#3287208 | Valid | HackerOne | No weakness recorded | – | 2026-04-16 | – | 185 |
| adding h1_analyst_* to username for normal usersAnalysed#1770797 | Valid | HackerOne | Input Validation and Logic | – | 2023-04-12 | $500 | 187 |
| IDOR on GraphQL queries BillingDocumentDownload and BillDetailsAnalysed#2207248 | Valid | Shopify | Insecure Direct Object Reference | – | 2024-02-08 | $5,000 | 187 |
| Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuseAnalysed#286740 | Valid | Internet Bug Bounty | Cryptography | – | 2017-11-03 | – | 191 |
| Able to approve admin approval and change effective status without adding payment details .Analysed#1543159 | Valid | Input Validation and Logic | – | 2022-06-22 | $5,000 | 191 | |
| Stored Xss Vulnerability on ████████Analysed#380103 | Valid | U.S. Dept Of Defense | Cross-site Scripting | – | 2020-05-14 | – | 192 |
| XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)Analysed#220852 | Valid | Rockstar Games | Cross-site Scripting | – | 2021-06-03 | – | 194 |
| An invite-only's program submission state is accessible to users no longer part of the programAnalysed#800109 | Valid | HackerOne | Information Disclosure | – | 2020-04-21 | $500 | 194 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | GitLab | File and Path Handling | – | 2021-05-24 | $16,000 | 194 |
| H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingAnalysed#422043 | Valid | Shopify | Cross-site Scripting | – | 2019-04-17 | – | 195 |
| Verify any unused email addressAnalysed#574962 | Valid | X / xAI | Access Control | – | 2019-06-24 | $560 | 197 |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.comAnalysed#84601 | Valid | X / xAI | Cross-site Scripting | – | 2019-05-01 | – | 198 |
| Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL apiAnalysed#1711938 | Valid | GitHub | Access Control | – | 2023-01-26 | – | 198 |
| Able to bypass email verification and change email to any other user emailAnalysed#1551176 | Valid | Access Control | – | 2022-05-06 | $5,000 | 200 | |
| HackerOne making payments in USDC (Coinbase stable coin)Analysed#1220747 | Valid | HackerOne | No weakness recorded | – | 2021-06-17 | – | 201 |
| Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originAnalysed#389108 | Valid | Superhuman (formerly Grammarly) | No weakness recorded | – | 2019-08-01 | – | 202 |
| IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalAnalysed#915114 | Valid | Automattic | Insecure Direct Object Reference | – | 2020-11-18 | – | 202 |
| Privilege escalation in workers containerAnalysed#692603 | Valid | Semmle | Access Control | – | 2019-09-25 | $1,500 | 206 |
| Ability to create own account UUID leads to stored XSSAnalysed#249131 | Valid | Upserve | Cross-site Scripting | – | 2019-06-10 | $1,500 | 207 |
| 2FA Bypass leads to impersonation of legimate usersAnalysed#2885636 | Valid | Drugs.com | Authentication | High | 2025-03-14 | – | 207 |
| ETH contract handling errorsAnalysed#328526 | Valid | Coinbase | Input Validation and Logic | – | 2018-04-04 | – | 208 |
| Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formAnalysed#418767 | Valid | HackerOne | Access Control | – | 2018-10-31 | $10,000 | 208 |
| IDOR allows an attacker to modify the links of any userAnalysed#1661113 | Valid | Insecure Direct Object Reference | – | 2022-09-30 | – | 208 | |
| Uploading large payload on domain instructions causes server-side DoSAnalysed#887321 | Valid | HackerOne | Denial of Service | – | 2020-06-20 | $2,500 | 210 |
| IDOR vulnerability in unreleased HackerOne Copilot featureAnalysed#2218334 | Valid | HackerOne | Insecure Direct Object Reference | – | 2023-10-25 | – | 210 |
| Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusAnalysed#654198 | Valid | HackerOne | Information Disclosure | – | 2019-09-29 | $500 | 213 |
| HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersAnalysed#1103582 | Valid | HackerOne | Authentication | – | 2021-04-01 | $3,000 | 213 |
| I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Analysed#391092 | Valid | Yelp | Insecure Direct Object Reference | – | 2020-08-19 | – | 214 |
| SSRF in webhooks leads to AWS private keys disclosureAnalysed#508459 | Valid | Omise | Server-Side Request Forgery | – | 2019-06-28 | – | 214 |
| IDOR delete any Tickets on ads.tiktok.comAnalysed#1475520 | Valid | TikTok | Insecure Direct Object Reference | – | 2022-03-02 | – | 216 |
| XSS via Mod Log Removed PostsAnalysed#1504410 | Valid | Cross-site Scripting | – | 2022-03-10 | – | 218 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.