Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [CRITICAL] Full account takeover using CSRFAnalysed#235642 | Valid | Cross-Site Request Forgery | High | 2017-11-03 | – | 88 |
| Denial of Service | twitter.com & mobile.twitter.comAnalysed#903740 | Valid | Denial of Service | Medium | 2020-09-02 | $1,120 | 89 |
| Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointAnalysed#1694304 | Valid | Access Control | Medium | 2024-03-01 | – | 91 |
| Bypassing Digits bridge origin validationAnalysed#110467 | Valid | Authentication | – | 2017-04-30 | – | 92 |
| Github Token Leaked publicly for https://github.com/mopubAnalysed#612231 | Valid | Cryptography | Medium | 2019-08-15 | – | 92 |
| Attacker can get vine repost user all informations even Ip address and location .Analysed#201300 | Valid | Authentication | – | 2017-03-25 | – | 95 |
| Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirectAnalysed#499348 | Valid | Access Control | Critical | 2019-04-29 | – | 95 |
| Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMsAnalysed#712979 | Valid | Injection and Smuggling | Low | 2020-01-24 | – | 96 |
| Safe Redirect BypassAnalysed#945990 | Valid | Other weaknesses | Low | 2020-09-10 | $560 | 98 |
| Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataAnalysed#1369674 | Valid | Cross-site Scripting | Critical | 2022-02-12 | – | 99 |
| Remote Unrestricted file Creation/Deletion and Possible RCE.Analysed#191884 | Valid | Command and Code Injection | Low | 2017-02-26 | – | 100 |
| Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Analysed#470749 | Valid | Input Validation and Logic | Critical | 2019-09-26 | – | 106 |
| Bypassing Digits web authentication's host validation with HPPAnalysed#114169 | Valid | Authentication | – | 2016-08-12 | – | 108 |
| Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileAnalysed#2244229 | Valid | Information Disclosure | Medium | 2024-05-10 | $1,500 | 115 |
| [URGENT] Opportunity to publish tweets on any twitters accountAnalysed#208978 | Valid | No weakness recorded | High | 2017-05-22 | – | 119 |
| Changing email address on Twitter for Android unsets "Protect your Tweets"Analysed#472013 | Valid | Information Disclosure | Low | 2019-01-18 | $2,940 | 119 |
| Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]Analysed#202823 | Valid | Information Disclosure | Critical | 2017-07-11 | – | 121 |
| XSS via referrer parameterAnalysed#867616 | Valid | Cross-site Scripting | Medium | 2020-10-26 | – | 124 |
| Incorrect param parsing in Digits web authenticationAnalysed#126522 | Valid | Authentication | – | 2018-08-18 | – | 126 |
| Highly wormable clickjacking in player cardAnalysed#85624 | Valid | Misconfiguration and Insecure Design | – | 2018-05-17 | – | 134 |
| Reflected XSS in twitterflightschool.comAnalysed#770349 | Valid | Cross-site Scripting | None | 2020-02-21 | – | 140 |
| IDOR and statistics leakage in OrdersAnalysed#544329 | Valid | Insecure Direct Object Reference | Medium | 2019-06-14 | $289 | 141 |
| character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorAnalysed#819088 | Valid | Denial of Service | Medium | 2020-05-06 | – | 141 |
| url that twitter mobile site can not loadAnalysed#500686 | Valid | Denial of Service | Low | 2019-03-19 | $1,120 | 142 |
| Twitter Periscope Clickjacking VulnerabilityAnalysed#591432 | Valid | Misconfiguration and Insecure Design | Medium | 2019-07-10 | $1,120 | 144 |
| Twitter ID exposure via error-based side-channel attackAnalysed#505424 | Valid | Information Disclosure | Medium | 2019-05-16 | $1,470 | 154 |
| Takeover of Twitter-owned domain at mobileapplinking.comAnalysed#321699 | Valid | Input Validation and Logic | None | 2019-02-28 | – | 159 |
| protected Tweet settings overwritten by other settingsAnalysed#664038 | Valid | No weakness recorded | Medium | 2020-01-01 | – | 178 |
| Verify any unused email addressAnalysed#574962 | Valid | Access Control | – | 2019-06-24 | $560 | 197 |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.comAnalysed#84601 | Valid | Cross-site Scripting | – | 2019-05-01 | – | 198 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | Cross-site Scripting | High | 2018-09-06 | – | 213 |
| Discoverability by phone number/email restriction bypassAnalysed#1439026 | Valid | Access Control | High | 2022-02-11 | $5,040 | 217 |
| Github Account hijack through broken link in developer.twitter.comAnalysed#1031321 | Valid | Input Validation and Logic | High | 2021-02-04 | – | 222 |
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | Cross-Site Request Forgery | Low | 2020-02-21 | $1,540 | 224 |
| Stored XSS on reports.Analysed#485748 | Valid | Cross-site Scripting | High | 2019-04-01 | $700 | 232 |
| XSS via Direct Message deeplinksAnalysed#341908 | Valid | Cross-site Scripting | – | 2019-05-09 | – | 236 |
| XSS and Open Redirect on MoPub LoginAnalysed#683298 | Valid | Open Redirect | – | 2019-09-24 | $1,540 | 248 |
| XXE on sms-be-vip.twitter.com in SXMP ProcessorAnalysed#248668 | Valid | Injection and Smuggling | Medium | 2017-07-26 | – | 258 |
| Insufficient validation on Digits bridgeAnalysed#168116 | Valid | Authentication | – | 2020-08-20 | – | 263 |
| Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293 | Valid | Authentication | – | 2019-04-10 | – | 277 |
| Bypass Password Authentication for updating email and phone number - Security VulnerabilityAnalysed#770504 | Valid | Authentication | High | 2020-02-08 | – | 288 |
| [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779 | Valid | Denial of Service | – | 2019-04-25 | – | 323 |
| Private list members disclosure via GraphQLAnalysed#885539 | Valid | Access Control | Low | 2020-08-04 | – | 346 |
| Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040 | Valid | Cross-site Scripting | Critical | 2021-07-09 | – | 357 |
| Read-only application can publish/delete fleetsAnalysed#1032468 | Valid | Access Control | Medium | 2021-01-04 | – | 398 |
| CRLF injectionAnalysed#446271 | Valid | No weakness recorded | Medium | 2019-12-25 | – | 439 |
| Bypassing Digits origin validation which leads to account takeoverAnalysed#129873 | Valid | Authentication | – | 2020-06-24 | – | 619 |
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | Command and Code Injection | Critical | 2019-08-10 | $20,160 | 1,246 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.