Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Export vault feature is vulnerable to CSV injection#272272	Informative	Command and Code Injection	–	2017-09-28	–	2
Tracking Bitwarden firefox addon users#337189	Valid	No weakness recorded	–	2018-05-23	–	7
When uploading attachments, unencrypted file names are made available to the server#1206799	Valid	Cryptography	–	2021-08-02	–	8
Rate limits too low for email 2FA#979820	Valid	Authentication	–	2020-10-14	–	11
Server-Side Request Forgery in "icons.bitwarden.net"#913276	Valid	Server-Side Request Forgery	–	2020-08-07	–	13
Mailgun misconfiguration on email.bitwarden.com#272357	Valid	Input Validation and Logic	–	2017-10-27	–	17
Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes#1874155	Valid	Cryptography	–	2023-06-07	–	19
Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)#925527	Valid	Server-Side Request Forgery	–	2020-09-11	–	21
Vulnerable exported broadcast receiver#289000	Valid	Misconfiguration and Insecure Design	–	2017-11-10	–	24
Organization Admin Privilege Escalation To Owner#272570	Valid	Input Validation and Logic	–	2017-10-28	–	28
Bypass for forced re-authentication upon biometrics change#1929915	Valid	Authentication	–	2023-07-19	–	37

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.