GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 Recently added 'Country' field doesn't send email notification when changed Analysed #961841 Valid Misconfiguration and Insecure Design Low 2020-08-25 – 108 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 HackerOne Code sends live password-reset tokens to Segment in automatic page events Analysed #4000185 Valid Authentication Low 2026-09-24 $200 115 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Race Conditions in Popular reports feature. Analysed #146845 Valid Memory Corruption – 2016-08-03 – 125 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting Medium 2018-08-04 – 129 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded Medium 2021-08-24 $2,500 130 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control Low 2017-03-27 – 134 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure None 2019-10-21 $2,500 138 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure Medium 2017-02-24 – 140 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Blind SSRF on errors.hackerone.net due to Sentry misconfiguration Analysed #374737 Valid Server-Side Request Forgery Low 2018-07-04 $3,500 143 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication Medium 2018-03-25 – 145 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting Medium 2021-06-24 – 146 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery High 2021-07-07 $2,500 149 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid Misconfiguration and Insecure Design – 2017-08-29 – 153 Race Condition leads to undeletable group member Analysed #604534 Valid Race Conditions Low 2020-03-20 – 153 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design Low 2016-09-20 – 154 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic Low 2019-04-05 – 154 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 Web Authentication Endpoint Credentials Brute-Force Vulnerability Analysed #127844 Valid Authentication – 2016-06-23 – 161 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure Low 2020-02-28 $500 168 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171