IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user #2618486 Informative Insecure Direct Object Reference Low 2024-08-09 – 47 Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API Analysed #1298902 Valid Access Control Low 2021-10-27 – 52 Image queue default key of 'None' and GraphQL unhandled type exception Analysed #996041 Valid Memory Corruption Medium 2021-10-27 $500 65 GPS metadata preserved when converting HEIF to PNG Analysed #1069039 Valid Information Disclosure High 2021-10-21 – 67 Reddit talk promotion offers don't expire, allowing users to accept them after being demoted Analysed #1656380 Valid Insecure Direct Object Reference Medium 2022-10-03 – 72 s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh Analysed #1285598 Valid Input Validation and Logic High 2021-10-21 – 96 Regression on dest parameter sanitization doesn't check scheme/websafe destinations Analysed #1962951 Valid Cross-site Scripting Medium 2023-06-03 $500 101 XSS Reflected on reddit.com via url path Analysed #1051373 Valid Cross-site Scripting High 2022-09-27 – 157 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability Analysed #1658418 Valid Insecure Direct Object Reference High 2022-08-04 $5,000 163 Reflected xss in https://sh.reddit.com Analysed #1549206 Valid Cross-site Scripting High 2022-05-08 $5,000 166 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application. Analysed #1596663 Valid Access Control High 2022-11-14 – 186 Able to approve admin approval and change effective status without adding payment details . Analysed #1543159 Valid Input Validation and Logic High 2022-06-22 $5,000 191 Able to bypass email verification and change email to any other user email Analysed #1551176 Valid Access Control High 2022-05-06 $5,000 200 IDOR allows an attacker to modify the links of any user Analysed #1661113 Valid Insecure Direct Object Reference High 2022-09-30 – 208 XSS via Mod Log Removed Posts Analysed #1504410 Valid Cross-site Scripting High 2022-03-10 – 218 Infromation Disclosure To Use of Hard-coded Cryptographic Key #2353237 Duplicate Cryptography Medium 2024-02-06 – 238 Deleting all DMs on RedditGifts.com Analysed #1213237 Valid Insecure Direct Object Reference High 2021-10-21 $5,000 267 RichText parser vulnerability in scheduled posts allows XSS Analysed #1930763 Valid Cross-site Scripting High 2023-04-20 $5,000 280 Exposed proxy allows to access internal reddit domains Analysed #2967634 Valid Access Control High 2025-02-24 $7,500 296 Blind SSRF to internal services in matrix preview_link API Analysed #1960765 Valid Server-Side Request Forgery High 2023-04-26 $6,000 344 [accounts.reddit.com] Redirect parameter allows for XSS Analysed #1962645 Valid Cross-site Scripting High 2023-05-18 $5,000 394 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com Analysed #1567186 Valid Access Control Critical 2022-08-02 – 509