Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Potential for Double Spend via Sign Message Utility#106315 | Informative | Cryptography | – | 2016-01-06 | – | – |
| Information disclosue in Android Application#201855 | Duplicate | Denial of Service | – | 2017-08-30 | – | – |
| CSRF bug on password change#230436 | N/A | Cross-Site Request Forgery | – | 2017-08-28 | – | – |
| Device confirmation Flaw#254869 | Informative | No weakness recorded | – | 2017-08-02 | – | – |
| CSRF in function "Set as primary" on accounts page#10829 | Valid | Cross-Site Request Forgery | – | 2014-06-06 | – | 1 |
| iframes considered harmful#55827 | Informative | Misconfiguration and Insecure Design | – | 2015-12-01 | – | 1 |
| Big Bug with Vault which i have already reported: Case #606962#65084 | Valid | No weakness recorded | – | 2016-01-20 | – | 1 |
| Runtime manipulation iOS app breaking the PIN#80512 | Informative | Misconfiguration and Insecure Design | – | 2016-11-16 | – | 1 |
| SPF records not found#92740 | Valid | Misconfiguration and Insecure Design | – | 2015-10-14 | – | 1 |
| Misconfiguration in 2 factor allows sensitive data expose#119129 | Valid | Information Disclosure | – | 2016-03-04 | $500 | 1 |
| Inaccurate Payment receipt#121417 | Informative | No weakness recorded | – | 2017-08-30 | – | 1 |
| Cookie not secure#140742 | N/A | No weakness recorded | – | 2016-05-25 | – | 1 |
| Transaction Pending Via Ip Change#143541 | Informative | No weakness recorded | – | 2016-06-07 | – | 1 |
| Information disclosure in coinbase android app#192197 | Informative | Authentication | – | 2017-08-30 | – | 1 |
| X-Frame-Options#237071 | Informative | Misconfiguration and Insecure Design | – | 2017-06-22 | – | 1 |
| New Device Confirmation Bug#266288 | Informative | No weakness recorded | – | 2017-09-08 | – | 1 |
| User provided values passed to PHP unset() function#292500 | Informative | Memory Corruption | – | 2018-04-09 | – | 1 |
| User provided values trusted in sensitive actions#327867 | Informative | No weakness recorded | – | 2018-04-09 | – | 1 |
| Improper Validation of the Referrer header leading to Open URL Redirection#5199 | Informative | Open Redirect | – | 2014-04-29 | – | 2 |
| Cookie missing the HttpOnly flag#5204 | Informative | No weakness recorded | – | 2014-04-30 | – | 2 |
| IFRAME loaded from External Domains#5205 | Informative | No weakness recorded | – | 2014-04-30 | – | 2 |
| 2 factor authentication design flaw#7369 | Valid | Misconfiguration and Insecure Design | – | 2014-06-06 | – | 2 |
| Credit Card Validation Issue#29234 | Valid | No weakness recorded | – | 2015-03-12 | – | 2 |
| Balance Manipulation - BUG#94925 | Informative | No weakness recorded | – | 2016-02-26 | – | 2 |
| Direct URL access to completed reports#109815 | Valid | Authentication | – | 2016-03-06 | $200 | 2 |
| User's legal name could be changed despite front end controls being disabled#131192 | Valid | Misconfiguration and Insecure Design | – | 2016-05-05 | – | 2 |
| Window.opener bug at www.coinbase.com#181088 | Valid | No weakness recorded | – | 2016-11-28 | $100 | 2 |
| Csrf bug on signup session#230428 | Informative | Cross-Site Request Forgery | – | 2017-08-30 | – | 2 |
| Information Disclosure That shows the webroot of CoinBase Server#5073 | Informative | Information Disclosure | – | 2014-05-04 | – | 3 |
| Multiple Issues related to registering applications#5933 | Valid | Misconfiguration and Insecure Design | – | 2014-05-29 | $1,000 | 3 |
| CSRF on "Set as primary" option on the accounts page#10563 | Valid | Cross-Site Request Forgery | – | 2014-07-26 | $100 | 3 |
| Invoice Details activate JS that filled in#21034 | Valid | Cross-site Scripting | – | 2015-03-30 | – | 3 |
| New Device Confirmation, token is valid until not used.#36594 | Valid | Cryptography | – | 2015-05-24 | – | 3 |
| Sandboxed iframes don't show confirmation screen#54733 | Valid | Misconfiguration and Insecure Design | – | 2015-04-04 | – | 3 |
| XXE in OAuth2 Applications gallery profile App logo#104620 | Informative | No weakness recorded | – | 2015-12-16 | – | 3 |
| Sending payments via QR code does not require confirmation#126784 | Valid | Authentication | – | 2016-04-22 | $1,000 | 3 |
| Open redirect on sign in#231760 | N/A | Open Redirect | – | 2017-06-23 | – | 3 |
| User Enumeration, Information Disclosure and Lack of Rate Limitation on API#5200 | Informative | Misconfiguration and Insecure Design | – | 2014-03-31 | – | 4 |
| Simultaneous Session Logon : Improper Session Management#11722 | Informative | Authentication | – | 2014-08-26 | – | 4 |
| open authentication bug#48065 | Valid | Authentication | – | 2015-03-11 | – | 4 |
| The 'Create a New Account' action is vulnerable to CSRF#109810 | N/A | Cross-Site Request Forgery | – | 2016-07-24 | – | 4 |
| An adversary can overwhelm the resources by automating Forgot password/Sign Up requests#119605 | N/A | Authentication | – | 2016-07-24 | – | 4 |
| 2FA settings allowed to be changed with no delay/freeze on funds#16696 | Informative | Misconfiguration and Insecure Design | – | 2014-08-25 | – | 5 |
| New Device confirmation tokens are not properly validated.#30238 | Valid | Authentication | – | 2015-05-25 | $100 | 5 |
| Two-factor authentication (via SMS)#66223 | Informative | Authentication | – | 2015-06-16 | – | 5 |
| OAUTH pemission set as true= lead to authorize malicious application#87561 | Valid | Authentication | – | 2015-12-01 | $100 | 5 |
| No authorization required in Windows phone web-application#148537 | Duplicate | Authentication | – | 2016-06-30 | – | 5 |
| Create Multiple Account Using Similar X-CSRF token#155726 | N/A | Misconfiguration and Insecure Design | – | 2016-08-09 | – | 5 |
| window.opener is leaking to external domains upon redirect on Safari#160498 | Valid | Misconfiguration and Insecure Design | – | 2016-08-22 | – | 5 |
| User email enumuration using Gmail#90308 | Valid | Information Disclosure | – | 2015-12-23 | – | 6 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.