Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unsubscripe linkes leaked#1439025	Duplicate	No weakness recorded	–	2022-03-09	–	3
Error Page Content Spoofing or Text Injection#1444031	Informative	Misconfiguration and Insecure Design	–	2022-03-09	–	8
Force User to Accept Attacker's invite [ Restrict user to create account]#1420070	Valid	Access Control	–	2022-04-25	–	10
Visibility Robots.txt file#1450014	Duplicate	Information Disclosure	–	2022-04-25	–	19
Log4j CVE-2021–44228#1431624	Informative	Command and Code Injection	–	2021-12-29	–	21
Card requirement bypass for business trial#1670304	Valid	Access Control	–	2022-10-21	–	22
[api.krisp.ai] Race condition on /v2/seats endpoint allows bypassing the original seat limit#1418419	Valid	Race Conditions	–	2022-04-04	–	26
Add more seats by paying less via PUT /v2/seats request manipulation#1446090	Valid	Input Validation and Logic	–	2022-06-20	–	30
Authentication CSRF resulting in unauthorized account access on Krisp app#1267476	Valid	Authentication	–	2022-06-20	–	35
Authentication bypass for ███ leads to take over any users account.#1608151	Valid	Authentication	–	2022-10-31	–	48
SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai#1842674	Valid	Deserialization and Object Injection	–	2023-02-22	–	119

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.