404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure Low 2020-05-16 – 173 SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter Analysed #435066 Valid SQL Injection Critical 2018-11-30 – 174 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql Analysed #3694007 Valid Command and Code Injection High 2026-06-17 $7,000 174 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars Analysed #815085 Valid Misconfiguration and Insecure Design Low 2024-02-04 $3,750 176 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Markdown parsing issue enables insertion of malicious tags and event handlers Analysed #299728 Valid Cross-site Scripting High 2018-01-29 $5,000 184 DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API Analysed #3287208 Valid No weakness recorded – 2026-04-16 – 185 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure Low 2020-04-21 $500 194 Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos Analysed #1034257 Valid Misconfiguration and Insecure Design Medium 2021-03-25 – 194 2020-10-09 Credential Stuffing Attack Analysed #1007689 Valid No weakness recorded – 2020-10-13 – 196 HackerOne making payments in USDC (Coinbase stable coin) Analysed #1220747 Valid No weakness recorded None 2021-06-17 – 201 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid Cross-site Scripting Low 2019-02-21 $500 208 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 Uploading large payload on domain instructions causes server-side DoS Analysed #887321 Valid Denial of Service Medium 2020-06-20 $2,500 210 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 HackerOne Jira integration plugin Leaked JWT to unauthorized jira users Analysed #1103582 Valid Authentication Medium 2021-04-01 $3,000 213 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Internal Access to Hackerone confluence Docs Analysed #3113398 Valid Misconfiguration and Insecure Design High 2025-08-15 $12,500 227 Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack Analysed #1181946 Valid Denial of Service Medium 2021-12-22 – 228 HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization Analysed #2101076 Valid Memory Corruption High 2024-02-04 – 228 Account takeover of existing HackerOne accounts through SCIM provisioning Analysed #3178999 Valid Access Control High 2025-07-17 – 232 Reflected XSS on www.hackerone.com via Wistia embed code Analysed #986386 Valid Cross-site Scripting Low 2020-09-24 $500 236 Cross-site Scripting (XSS) on HackerOne careers page Analysed #474656 Valid Cross-site Scripting Low 2019-02-17 $500 239 Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions Medium 2018-12-27 – 240 Denial of service via cache poisoning Analysed #409370 Valid Denial of Service Medium 2018-12-22 $2,500 253 View Titles of Private Reports with pending email invitation Analysed #2312029 Valid Access Control High 2024-01-16 – 257 Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint Analysed #2487889 Valid Insecure Direct Object Reference Critical 2024-05-23 – 266 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure Medium 2017-01-05 $10,000 287 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}` Analysed #1618347 Valid No weakness recorded Critical 2025-01-21 $25,000 295 An attacker can archive and unarchive any structured scope object on HackerOne Analysed #1501611 Valid No weakness recorded High 2022-04-18 – 318 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic Low 2020-10-15 – 322 Attachment disclosure via summary report Analysed #2442008 Valid Insecure Direct Object Reference Critical 2024-04-29 – 340 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick Analysed #1858574 Valid File and Path Handling Critical 2023-03-16 – 371 IDOR allows user to access report details via reference.json endpoint Analysed #3862641 Valid Insecure Direct Object Reference Critical 2026-10-01 $15,000 372 Reflected XSS on www.hackerone.com and resources.hackerone.com Analysed #840759 Valid Cross-site Scripting Low 2020-05-05 $500 387 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 June 2022 Incident Report Analysed #1622449 Valid No weakness recorded Critical 2022-07-01 – 426 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 How the Bug stole hacking Analysed #762510 Valid Insecure Direct Object Reference None 2019-12-20 – 471 profile-picture name parameter with large value lead to DoS for other users and programs on the platform Analysed #764434 Valid Denial of Service Medium 2020-03-25 – 475