Content Spoofing #1165919 N/A Input Validation and Logic – 2021-10-21 – 1 Content Spoofing/Text Injection at https://gateway-production.dubsmash.com #1166770 N/A Input Validation and Logic – 2021-10-27 – 1 Vulnerability Name: URL Redirection / Unvalidate Open Redirect #1182824 N/A Open Redirect – 2021-10-21 – 2 No Password Length Restriction leads to Denial of Service #1243009 Duplicate Denial of Service – 2021-10-21 – 2 com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack) #1325649 Duplicate Input Validation and Logic – 2021-12-13 – 2 No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com #1425884 No longer public No weakness recorded – – – 2 Several Subdomains Takeover #1591085 N/A No weakness recorded – 2022-06-08 – 2 Email Verification Bypass And Get access to user's private invitation. #1350401 N/A Input Validation and Logic – 2021-10-21 – 3 CVE-2020-11022 #1812768 N/A Cross-site Scripting – 2023-05-18 – 3 S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com) #1276733 Informative Access Control – 2021-10-21 – 4 Reflected XSS via File Upload #1816181 N/A Cross-site Scripting – 2023-05-18 – 4 Broken Authendication And Session Management #1167029 N/A Access Control – 2021-10-21 – 5 sensitive data exposure #1716249 N/A Information Disclosure – 2022-11-10 – 5 Broken links make users from France unable to understand the allowed content policy #1461207 Informative No weakness recorded – 2023-05-18 – 6 Regular Expression Denial of Service vulnerability #1538157 Informative Denial of Service – 2022-04-12 – 6 No Rate limit on change password leads to account takeover #1165285 Duplicate Authentication – 2021-12-13 – 8 hardcoded api secret & api key in com.reddit.frontpage #1241116 Informative Authentication – 2021-10-21 – 8 Huge amount of Subdomains Takeovers at Reddit.com #1966262 Duplicate Access Control – 2023-05-18 – 8 User Account has been taken out #1195340 Duplicate Authentication – 2021-10-21 – 9 Rate limit is implemented in Reddit , but its not working . #1609004 Duplicate Authentication – 2023-05-18 – 9 XSS in redditmedia.com can compromise data of reddit.com #862882 N/A Cross-site Scripting – 2022-08-03 – 10 critical file found etc/passwd on www.reddit.com #1187003 N/A Information Disclosure – 2021-10-21 – 10 XSS #1209098 N/A Cross-site Scripting – 2021-10-21 – 10 Open Redirect through POST Request in www.redditinc.com #1310230 Informative Open Redirect – 2022-07-08 – 10 registering with the same email address multiple times leads to account takeover #785833 Informative Authentication – 2022-03-14 – 11 Application level DOS at Login Page ( Accepts Long Password ) #1168804 Informative No weakness recorded – 2022-02-07 – 11 No rate limit leads to spaming post #1206004 Duplicate Authentication – 2023-05-18 – 11 HTML injection in API response including request url #1719588 Informative File and Path Handling – 2023-05-18 – 11 oauth misconfigration lead to account takeover #1815463 Informative Access Control – 2023-05-18 – 11 Missing rate limit in current password change settings leads to Account takeover #1170522 Duplicate Authentication – 2021-10-27 – 13 read and message other user's messages #1744264 N/A Insecure Direct Object Reference – 2023-05-18 – 14 api keys leaked #1762927 Informative Access Control – 2022-11-10 – 16 [dubsmash] Username and password bruteforce #1165225 Valid Authentication – 2021-12-13 – 18 Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations` #1543770 Valid Input Validation and Logic – 2022-07-04 $100 19 Misconfigurated login page able to lock login action for any account without user interaction #1582778 Informative No weakness recorded – 2022-06-06 – 19 Domain Takeover of Reddit.ru via DNS Hijacking #1226891 Valid Access Control – 2021-10-21 $500 20 Can use the Reddit android app as usual even though revoking the access of it from reddit.com #1632186 Informative Authentication – 2022-07-16 – 20 [dubmash] Lack of authorization checks - Update Sound Titles #1102365 Valid Access Control – 2021-10-21 – 21 Oauth Misconfiguration Lead To Account Takeover #1212374 Duplicate Access Control – 2021-10-21 – 21 Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753 #1285081 Valid Open Redirect – 2022-09-30 – 21 No Rate Limit on redditgifts gift when Adding Comment #1202408 Valid Misconfiguration and Insecure Design – 2021-10-21 – 25 Third party app could steal access token as well as protected files using inAppBrowser #1122177 Valid Information Disclosure – 2021-10-27 – 32 [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile #1237428 Valid Denial of Service – 2021-12-13 – 33 Unrestricted File Upload on reddit.secure.force.com #1606957 Valid No weakness recorded – 2022-09-30 $100 34 Weak rate limit could lead to ATO due to weak password protection mechanisms #1065186 Valid Authentication – 2021-12-15 – 39 Open Redirect on www.redditinc.com via `failed` query param #1257753 Valid Open Redirect – 2022-09-22 – 41 Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase #801743 Valid Race Conditions – 2021-10-27 – 42 IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter #1213765 Valid Input Validation and Logic – 2021-10-21 $500 42 Hash-Collision Denial-of-Service Vulnerability in Markdown Parser #1341957 Valid Denial of Service – 2021-10-21 – 44 CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit ! #1480569 Valid Cross-Site Request Forgery – 2022-06-16 – 47