Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Moderator user has access to owner's support portal and tickets#1071918	Valid	Access Control	Medium	2021-01-20	$200	19
Stored XSS on oslo.io in notifications via project name change#1070859	Valid	Cross-site Scripting	Medium	2021-01-05	–	26
Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=#1327742	Valid	No weakness recorded	Medium	2021-11-04	–	27
Sensitive information disclosure to shared access user via streamlabs platform api#1072893	Valid	Information Disclosure	Medium	2021-01-20	$200	36
SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot#1108418	Valid	Server-Side Request Forgery	Medium	2021-02-24	$200	41
CSRF in changing users donation_settings [https://streamlabs.com/api/v6/viewer-portal/viewer-settings/donation_settings]#1049360	Valid	Cross-Site Request Forgery	Medium	2020-12-26	–	49
session takeover via open protocol redirection on streamlabs.com#1178239	Valid	Open Redirect	Medium	2021-09-01	$200	50
Manipulating response leads to free access to Streamlabs PrimeAnalysed#1070510	Valid	Input Validation and Logic	Medium	2021-01-21	–	80
One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comAnalysed#1046630	Valid	Cross-Site Request Forgery	Medium	2021-01-06	–	99

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.