Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bypass Cloudflare WARP lock on iOS.#1542450	Valid	Input Validation and Logic	Medium	2022-11-07	$500	10
Extraction of Pages build scripts, config values, tokens, etc. via symlinks#1754811	Valid	Information Disclosure	Medium	2023-03-06	$500	12
Session mismatch leading to potential account takeover (local access required)#1825227	Valid	Insecure Direct Object Reference	Medium	2023-04-10	–	16
Origin IP address disclosure through Pingora response header#1803659	Valid	Information Disclosure	Medium	2023-01-10	–	21
Cloudflare is not properly deleting user's account#1728292	Valid	Input Validation and Logic	Medium	2023-04-13	–	23
Take over subdomains of r2.dev using R2 custom domains#1700276	Valid	No weakness recorded	Medium	2022-09-28	$1,125	28
Bypassing Cache Deception Armor using .avif extension file#1391635	Valid	Information Disclosure	Medium	2022-06-27	–	36
Signup with any Email and Enable 2-FA without verifying Email#1543259	Valid	Authentication	Medium	2022-09-12	–	40
Arbitrary file read from Cloudflare Pages build environment#1570874	Valid	No weakness recorded	Medium	2024-02-23	–	40
Enable 2Fa verification without verifying email#1618021	Valid	Access Control	Medium	2022-08-31	–	40
Bypass R2 payment screenAnalysed#2170559	Valid	Authentication	Medium	2023-11-10	$350	57
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itAnalysed#3211031	Valid	Cross-site Scripting	Medium	2025-09-30	$550	75

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.