Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CSRF in function "Set as primary" on accounts page#10829 | Valid | Cross-Site Request Forgery | – | 2014-06-06 | – | 1 |
| Big Bug with Vault which i have already reported: Case #606962#65084 | Valid | No weakness recorded | – | 2016-01-20 | – | 1 |
| SPF records not found#92740 | Valid | Misconfiguration and Insecure Design | – | 2015-10-14 | – | 1 |
| Misconfiguration in 2 factor allows sensitive data expose#119129 | Valid | Information Disclosure | – | 2016-03-04 | $500 | 1 |
| 2 factor authentication design flaw#7369 | Valid | Misconfiguration and Insecure Design | – | 2014-06-06 | – | 2 |
| Credit Card Validation Issue#29234 | Valid | No weakness recorded | – | 2015-03-12 | – | 2 |
| Direct URL access to completed reports#109815 | Valid | Authentication | – | 2016-03-06 | $200 | 2 |
| User's legal name could be changed despite front end controls being disabled#131192 | Valid | Misconfiguration and Insecure Design | – | 2016-05-05 | – | 2 |
| Window.opener bug at www.coinbase.com#181088 | Valid | No weakness recorded | – | 2016-11-28 | $100 | 2 |
| Multiple Issues related to registering applications#5933 | Valid | Misconfiguration and Insecure Design | – | 2014-05-29 | $1,000 | 3 |
| CSRF on "Set as primary" option on the accounts page#10563 | Valid | Cross-Site Request Forgery | – | 2014-07-26 | $100 | 3 |
| Invoice Details activate JS that filled in#21034 | Valid | Cross-site Scripting | – | 2015-03-30 | – | 3 |
| New Device Confirmation, token is valid until not used.#36594 | Valid | Cryptography | – | 2015-05-24 | – | 3 |
| Sandboxed iframes don't show confirmation screen#54733 | Valid | Misconfiguration and Insecure Design | – | 2015-04-04 | – | 3 |
| Sending payments via QR code does not require confirmation#126784 | Valid | Authentication | – | 2016-04-22 | $1,000 | 3 |
| open authentication bug#48065 | Valid | Authentication | – | 2015-03-11 | – | 4 |
| New Device confirmation tokens are not properly validated.#30238 | Valid | Authentication | – | 2015-05-25 | $100 | 5 |
| OAUTH pemission set as true= lead to authorize malicious application#87561 | Valid | Authentication | – | 2015-12-01 | $100 | 5 |
| window.opener is leaking to external domains upon redirect on Safari#160498 | Valid | Misconfiguration and Insecure Design | – | 2016-08-22 | – | 5 |
| User email enumuration using Gmail#90308 | Valid | Information Disclosure | – | 2015-12-23 | – | 6 |
| Information disclosure of user by email using buy widget#176002 | Valid | Information Disclosure | – | 2016-11-16 | – | 6 |
| Leaking CSRF token over HTTP resulting in CSRF protection bypass#15412 | Valid | Cross-Site Request Forgery | – | 2014-10-16 | $1,000 | 7 |
| ByPassing the email Validation Email on Sign up process in mobile apps#57764 | Valid | Misconfiguration and Insecure Design | – | 2016-11-28 | $100 | 7 |
| Information leakage on https://docs.gdax.com#168509 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 7 |
| Information disclosure same issue #176002#248599 | Valid | No weakness recorded | – | 2017-07-21 | $100 | 7 |
| Transactions visible on Unconfirmed devices#100186 | Valid | Authentication | – | 2015-12-11 | $500 | 8 |
| Race condition allowing user to review app multiple times#106360 | Valid | No weakness recorded | – | 2016-01-14 | – | 8 |
| Session Issue Maybe Can lead to huge loss [CRITICAL]#112496 | Valid | Cryptography | – | 2016-02-21 | $1,000 | 10 |
| Email leak in transcations in Android app#126376 | Valid | Misconfiguration and Insecure Design | – | 2016-05-17 | $500 | 11 |
| Blacklist bypass on Callback URLs#53004 | Valid | Information Disclosure | – | 2016-09-14 | $100 | 12 |
| Application error message#147577 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 12 |
| Stored-XSS in https://www.coinbase.com/#100829 | Valid | Cross-site Scripting | – | 2015-12-07 | – | 13 |
| Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code#5314 | Valid | Information Disclosure | – | 2014-11-26 | – | 14 |
| XSSI (Cross Site Script Inclusion)#118631 | Valid | Cross-Site Request Forgery | – | 2017-08-22 | – | 15 |
| Stored CSS Injection#315865 | Valid | Injection and Smuggling | – | 2018-04-02 | – | 15 |
| OAuth authorization page vulnerable to clickjacking#65825 | Valid | Authentication | – | 2016-02-07 | – | 16 |
| Prepopulation of email address and name leaks information provided to other merchants#316290 | Valid | Misconfiguration and Insecure Design | – | 2018-04-02 | – | 16 |
| Bypassing 2FA for BTC transfers#10554 | Valid | Authentication | – | 2014-09-25 | $1,000 | 18 |
| Captcha Bypass in Coinbase SignUp Form#246801 | Valid | Misconfiguration and Insecure Design | – | 2017-09-05 | $100 | 23 |
| [buy.coinbase.com]Content Injection#218680 | Valid | No weakness recorded | – | 2017-05-25 | – | 26 |
| Authentication Issue#176979 | Valid | Access Control | – | 2017-01-05 | $200 | 27 |
| HTML injection in apps user review#104543 | Valid | No weakness recorded | – | 2015-12-21 | $200 | 31 |
| ETH contract handling errorsAnalysed#328526 | Valid | Input Validation and Logic | – | 2018-04-04 | – | 208 |
| Ethereum account balance manipulationAnalysed#300748 | Valid | Input Validation and Logic | – | 2018-03-21 | – | 276 |
| Double Payout via PayPalAnalysed#307239 | Valid | Input Validation and Logic | – | 2018-04-04 | $10,000 | 324 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.