Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Chaturbate "/chat_ignore_list/" endpoint does not check for Account status: Disabled before adding Ignore via POSTAnalysed#415398 | Valid | Input Validation and Logic | Low | 2018-10-31 | – | 16 |
| [chaturbate.com] - CSRF Vulnerability on image uploadAnalysed#401483 | Valid | No weakness recorded | Medium | 2018-09-19 | $300 | 17 |
| Stored XSS on chaturbate.com (wish list)Analysed#425048 | Valid | Cross-site Scripting | Low | 2018-11-06 | $100 | 18 |
| No rate limiting in changing room subject.Analysed#418145 | Valid | No weakness recorded | Low | 2018-10-09 | – | 19 |
| Missing Rate Limitation at /photo_videos/photoset/createAnalysed#426547 | Valid | Input Validation and Logic | Low | 2018-11-24 | – | 20 |
| Missing Rate Limitation at /apps/upload_app/Analysed#416906 | Valid | Input Validation and Logic | Low | 2018-10-07 | – | 21 |
| Update Chat Allowed By Option ( without age verification )Analysed#422698 | Valid | Input Validation and Logic | Low | 2018-10-18 | – | 23 |
| Camo Image Proxy Bypass with CSS Escape SequencesAnalysed#745953 | Valid | Injection and Smuggling | Low | 2019-12-18 | – | 25 |
| Rate limit missing at room loginAnalysed#385381 | Valid | Authentication | Medium | 2018-09-30 | $500 | 28 |
| Web cache deception attack - expose token informationAnalysed#397508 | Valid | Information Disclosure | Medium | 2018-09-20 | – | 28 |
| Stored XSS in chat topic due to insecure emoticon parsing on any message typeAnalysed#429298 | Valid | Cross-site Scripting | Medium | 2018-11-01 | $450 | 33 |
| DoS attacks utilizing camo.stream.highwebmedia.comAnalysed#507525 | Valid | Denial of Service | Medium | 2019-05-01 | $400 | 41 |
| Forget password link not expiring after email change.Analysed#411337 | Valid | Access Control | Medium | 2018-09-20 | – | 46 |
| Blind SSRF at https://chaturbate.com/notifications/update_push/Analysed#411865 | Valid | Server-Side Request Forgery | High | 2018-10-21 | – | 54 |
| Account Takeover via billingAnalysed#394329 | Valid | Access Control | Critical | 2018-09-19 | $8,000 | 56 |
| Passive stored XSS at broadcast roomAnalysed#423797 | Valid | Cross-site Scripting | High | 2018-11-06 | – | 74 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.