Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open Redirect at https://oauth.secure.pixiv.netAnalysed#972601 | Valid | Open Redirect | Low | 2020-12-22 | $200 | 29 |
| Bypass extension check leads to stored XSS at https://s2.booth.pmAnalysed#1019425 | Valid | Cross-site Scripting | Medium | 2021-01-08 | – | 30 |
| CSRF at https://chatstory.pixiv.net/importedAnalysed#534908 | Valid | Cross-Site Request Forgery | Medium | 2020-07-02 | $500 | 31 |
| Open redirect protection (https://www.pixiv.net/jump.php) is broken for novelsAnalysed#541862 | Valid | Open Redirect | Low | 2019-10-01 | $200 | 42 |
| RCE due to ImageTragick v2Analysed#402362 | Valid | Command and Code Injection | Critical | 2021-03-16 | $2,000 | 44 |
| Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.netAnalysed#3100570 | Valid | Access Control | Low | 2026-04-27 | – | 53 |
| XSS Reflected at https://sketch.pixiv.net/ Via `next_url`Analysed#1503601 | Valid | Cross-site Scripting | Medium | 2022-03-23 | – | 64 |
| clickjacing can lead to account takeoverAnalysed#2119892 | Valid | Misconfiguration and Insecure Design | Low | 2026-01-18 | $200 | 70 |
| Non-premium user can disable Ads in japanese version of dic.pixiv.netAnalysed#3183520 | Valid | Input Validation and Logic | High | 2026-04-27 | $3,000 | 123 |
| XSS reflected on [https://www.pixiv.net]Analysed#766633 | Valid | Cross-site Scripting | Medium | 2020-12-17 | $500 | 144 |
| Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Analysed#2473173 | Valid | Information Disclosure | High | 2026-01-20 | – | 145 |
| Disclose Hidden Comments on Media Section of hub.vroid.comAnalysed#2541962 | Valid | Insecure Direct Object Reference | Medium | 2026-01-18 | $500 | 149 |
| Stealing Users OAuth authorization code via redirect_uriAnalysed#1861974 | Valid | Access Control | High | 2023-03-22 | $2,000 | 253 |
| Reset any passwordAnalysed#703972 | Valid | Authentication | High | 2021-03-31 | – | 313 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.