Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Content Injection error page#148952 | Informative | Misconfiguration and Insecure Design | – | 2017-01-05 | – | 6 |
| coinbase Email leak while sending and requesting#168289 | Informative | Authentication | Low | 2016-10-11 | – | 6 |
| Information disclosure of user by email using buy widget#176002 | Valid | Information Disclosure | Medium | 2016-11-16 | – | 6 |
| Leaking CSRF token over HTTP resulting in CSRF protection bypass#15412 | Valid | Cross-Site Request Forgery | – | 2014-10-16 | $1,000 | 7 |
| ByPassing the email Validation Email on Sign up process in mobile apps#57764 | Valid | Misconfiguration and Insecure Design | – | 2016-11-28 | $100 | 7 |
| No authorization required in iOS device web-application#148538 | Duplicate | Authentication | – | 2016-06-30 | – | 7 |
| Information leakage on https://docs.gdax.com#168509 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 7 |
| Information disclosure same issue #176002#248599 | Valid | No weakness recorded | Low | 2017-07-21 | $100 | 7 |
| Transactions visible on Unconfirmed devices#100186 | Valid | Authentication | – | 2015-12-11 | $500 | 8 |
| Race condition allowing user to review app multiple times#106360 | Valid | No weakness recorded | – | 2016-01-14 | – | 8 |
| Coinbase Android Security Vulnerabilities#5786 | Informative | Cryptography | – | 2014-05-07 | – | 9 |
| Session Issue Maybe Can lead to huge loss [CRITICAL]#112496 | Valid | Cryptography | – | 2016-02-21 | $1,000 | 10 |
| Email leak in transcations in Android app#126376 | Valid | Misconfiguration and Insecure Design | – | 2016-05-17 | $500 | 11 |
| Blacklist bypass on Callback URLs#53004 | Valid | Information Disclosure | – | 2016-09-14 | $100 | 12 |
| Application error message#147577 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 12 |
| Stored-XSS in https://www.coinbase.com/#100829 | Valid | Cross-site Scripting | – | 2015-12-07 | – | 13 |
| Requestor Email Disclosure via Email Notification#202361 | Informative | Information Disclosure | Low | 2017-02-02 | – | 13 |
| Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code#5314 | Valid | Information Disclosure | – | 2014-11-26 | – | 14 |
| XSSI (Cross Site Script Inclusion)#118631 | Valid | Cross-Site Request Forgery | – | 2017-08-22 | – | 15 |
| Stored CSS Injection#315865 | Valid | Injection and Smuggling | – | 2018-04-02 | – | 15 |
| OAuth authorization page vulnerable to clickjacking#65825 | Valid | Authentication | – | 2016-02-07 | – | 16 |
| Prepopulation of email address and name leaks information provided to other merchants#316290 | Valid | Misconfiguration and Insecure Design | – | 2018-04-02 | – | 16 |
| Bypassing 2FA for BTC transfers#10554 | Valid | Authentication | – | 2014-09-25 | $1,000 | 18 |
| Captcha Bypass in Coinbase SignUp FormAnalysed#246801 | Valid | Misconfiguration and Insecure Design | Low | 2017-09-05 | $100 | 23 |
| [buy.coinbase.com]Content InjectionAnalysed#218680 | Valid | No weakness recorded | Low | 2017-05-25 | – | 26 |
| Authentication IssueAnalysed#176979 | Valid | Access Control | Low | 2017-01-05 | $200 | 27 |
| HTML injection in apps user reviewAnalysed#104543 | Valid | No weakness recorded | – | 2015-12-21 | $200 | 31 |
| ETH contract handling errorsAnalysed#328526 | Valid | Input Validation and Logic | Critical | 2018-04-04 | – | 208 |
| Ethereum account balance manipulationAnalysed#300748 | Valid | Input Validation and Logic | Critical | 2018-03-21 | – | 276 |
| Double Payout via PayPalAnalysed#307239 | Valid | Input Validation and Logic | Critical | 2018-04-04 | $10,000 | 324 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.