Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Potential for Double Spend via Sign Message Utility#106315 | Informative | Cryptography | – | 2016-01-06 | – | – |
| Big Bug with Vault which i have already reported: Case #606962#65084 | Valid | No weakness recorded | – | 2016-01-20 | – | 1 |
| Runtime manipulation iOS app breaking the PIN#80512 | Informative | Misconfiguration and Insecure Design | – | 2016-11-16 | – | 1 |
| Misconfiguration in 2 factor allows sensitive data expose#119129 | Valid | Information Disclosure | – | 2016-03-04 | $500 | 1 |
| Cookie not secure#140742 | N/A | No weakness recorded | – | 2016-05-25 | – | 1 |
| Transaction Pending Via Ip Change#143541 | Informative | No weakness recorded | – | 2016-06-07 | – | 1 |
| Balance Manipulation - BUG#94925 | Informative | No weakness recorded | – | 2016-02-26 | – | 2 |
| Direct URL access to completed reports#109815 | Valid | Authentication | – | 2016-03-06 | $200 | 2 |
| User's legal name could be changed despite front end controls being disabled#131192 | Valid | Misconfiguration and Insecure Design | – | 2016-05-05 | – | 2 |
| Window.opener bug at www.coinbase.com#181088 | Valid | No weakness recorded | – | 2016-11-28 | $100 | 2 |
| Sending payments via QR code does not require confirmation#126784 | Valid | Authentication | – | 2016-04-22 | $1,000 | 3 |
| The 'Create a New Account' action is vulnerable to CSRF#109810 | N/A | Cross-Site Request Forgery | – | 2016-07-24 | – | 4 |
| An adversary can overwhelm the resources by automating Forgot password/Sign Up requests#119605 | N/A | Authentication | – | 2016-07-24 | – | 4 |
| No authorization required in Windows phone web-application#148537 | Duplicate | Authentication | – | 2016-06-30 | – | 5 |
| Create Multiple Account Using Similar X-CSRF token#155726 | N/A | Misconfiguration and Insecure Design | – | 2016-08-09 | – | 5 |
| window.opener is leaking to external domains upon redirect on Safari#160498 | Valid | Misconfiguration and Insecure Design | – | 2016-08-22 | – | 5 |
| coinbase Email leak while sending and requesting#168289 | Informative | Authentication | Low | 2016-10-11 | – | 6 |
| Information disclosure of user by email using buy widget#176002 | Valid | Information Disclosure | Medium | 2016-11-16 | – | 6 |
| ByPassing the email Validation Email on Sign up process in mobile apps#57764 | Valid | Misconfiguration and Insecure Design | – | 2016-11-28 | $100 | 7 |
| No authorization required in iOS device web-application#148538 | Duplicate | Authentication | – | 2016-06-30 | – | 7 |
| Information leakage on https://docs.gdax.com#168509 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 7 |
| Race condition allowing user to review app multiple times#106360 | Valid | No weakness recorded | – | 2016-01-14 | – | 8 |
| Session Issue Maybe Can lead to huge loss [CRITICAL]#112496 | Valid | Cryptography | – | 2016-02-21 | $1,000 | 10 |
| Email leak in transcations in Android app#126376 | Valid | Misconfiguration and Insecure Design | – | 2016-05-17 | $500 | 11 |
| Blacklist bypass on Callback URLs#53004 | Valid | Information Disclosure | – | 2016-09-14 | $100 | 12 |
| Application error message#147577 | Valid | Information Disclosure | – | 2016-11-28 | $100 | 12 |
| OAuth authorization page vulnerable to clickjacking#65825 | Valid | Authentication | – | 2016-02-07 | – | 16 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.