Hogging up all the resources on hackerone.com Analysed #125587 Valid Denial of Service Medium 2019-04-10 – 44 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation Analysed #171398 Valid Cross-site Scripting Low 2016-10-27 – 44 Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com Analysed #199779 Valid Misconfiguration and Insecure Design Low 2017-03-26 – 44 ImageMagick GIF coder vulnerability leading to memory disclosure Analysed #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Disclosing a private program in an external link if program is paused Analysed #418474 Valid No weakness recorded Low 2019-06-28 $500 44 Ability to invite a new member on Sandbox Program Analysed #1088966 Valid Input Validation and Logic Low 2021-04-05 – 44 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Content Security Policy not applied to error pages at multiple HackerOne endpoints Analysed #250729 Valid Misconfiguration and Insecure Design Low 2017-12-12 – 45 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks Analysed #4071670 Valid Authentication Low 2026-10-08 $200 45 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification Analysed #242964 Valid Input Validation and Logic Medium 2017-11-01 – 46 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 Disclosure of the name of a program that has a private part with an external link Analysed #871142 Valid Information Disclosure Low 2020-05-22 $500 46 "Bounty splitting enabled" can discloses if public VDPs are running private VRP Analysed #1103812 Valid No weakness recorded Low 2021-03-18 – 46 Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information Analysed #1242680 Valid Information Disclosure Low 2021-06-24 – 46 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session Analysed #417382 Valid Authentication Low 2018-11-30 $500 47 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 information disclosure of another company bug on video. Analysed #1886143 Valid Information Disclosure Low 2023-03-12 – 47 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 Missing SPF for hackerone.com Analysed #120 Valid Misconfiguration and Insecure Design – 2014-01-09 – 48 Real impersonation Analysed #280 Valid No weakness recorded – 2013-11-30 – 48 Domain spoofing in redirect page using RTLO Analysed #299403 Valid Open Redirect Low 2018-01-30 – 48 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Attachment in published HackerOne report exposure private program Analysed #1869613 Valid Information Disclosure Low 2023-06-07 – 49 Websites opened from reports can change url of report page Analysed #189726 Valid Open Redirect Medium 2017-02-25 – 50 Subdomain takeover #4 at info.hacker.one Analysed #220002 Valid Access Control Low 2017-06-21 – 50 Total bounties paid amount is disclosed because of redesign of the Program Profiles Analysed #640488 Valid Information Disclosure Low 2019-08-02 – 50 Program managers can see draft reports using Export Reports feature Analysed #1664920 Valid Input Validation and Logic Low 2023-05-18 – 50 Staff and Triage can modify the initial post of a report, including of already disclosed reports Analysed #2096271 Valid Access Control Medium 2023-08-28 – 50 GIF flooding Analysed #400 Valid Denial of Service – 2013-11-30 $250 51 Extra program metrics disclosed via /PROGRAM_NAME json response Analysed #327088 Valid Information Disclosure Medium 2018-03-28 – 51 New link opening method makes hackerone vulnerable to tabnabbing Analysed #1159398 Valid Open Redirect Low 2021-07-07 – 51 Open Redirection in index.php page Analysed #320376 Valid Open Redirect None 2018-03-07 – 53 Hacker email disclosed on submission at hackerone hactivity Analysed #2215434 Valid Information Disclosure Low 2023-10-24 $100 53 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details Analysed #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Race condition in claiming program credentials Analysed #488985 Valid Race Conditions Low 2019-05-19 – 54 Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io Analysed #1028345 Valid Open Redirect None 2021-03-26 – 54 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports. Analysed #2000000 Valid Misconfiguration and Insecure Design Low 2023-07-11 – 54 New Search Feature: Search for non-public words in limited disclosure reports Analysed #2213251 Valid Information Disclosure Medium 2023-10-25 – 55 Register & create a ticket as somebody else on HackerOne Support Analysed #2082680 Valid Misconfiguration and Insecure Design None 2023-07-31 – 56 Invalid Host detection at https://hackerone.com/redirect Analysed #278095 Valid Misconfiguration and Insecure Design Low 2017-12-03 – 57 Private program policy page still accessible after user left the program Analysed #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Changing the 2FA secret key and backup codes without knowing the 2FA OTP Analysed #1139535 Valid Other weaknesses Medium 2021-05-06 – 57 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Subdomain takeover #3 at info.hacker.one Analysed #217358 Valid Access Control Low 2017-06-21 – 58 HackerOne Staging uses Production data for testing Analysed #1392511 Valid Information Disclosure Low 2021-11-05 – 58