Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Tracking Bitwarden firefox addon users#337189	Valid	No weakness recorded	High	2018-05-23	–	7
When uploading attachments, unencrypted file names are made available to the server#1206799	Valid	Cryptography	–	2021-08-02	–	8
Rate limits too low for email 2FA#979820	Valid	Authentication	Medium	2020-10-14	–	11
Server-Side Request Forgery in "icons.bitwarden.net"#913276	Valid	Server-Side Request Forgery	Medium	2020-08-07	–	13
Mailgun misconfiguration on email.bitwarden.com#272357	Valid	Input Validation and Logic	Low	2017-10-27	–	17
Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes#1874155	Valid	Cryptography	Medium	2023-06-07	–	19
Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)#925527	Valid	Server-Side Request Forgery	Low	2020-09-11	–	21
Vulnerable exported broadcast receiver#289000	Valid	Misconfiguration and Insecure Design	Low	2017-11-10	–	24
Organization Admin Privilege Escalation To Owner#272570	Valid	Input Validation and Logic	Medium	2017-10-28	–	28
Bypass for forced re-authentication upon biometrics change#1929915	Valid	Authentication	Medium	2023-07-19	–	37

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.