Several Subdomains Takeover #1591085 N/A No weakness recorded High 2022-06-08 – 2 sensitive data exposure #1716249 N/A Information Disclosure High 2022-11-10 – 5 critical file found etc/passwd on www.reddit.com #1187003 N/A Information Disclosure High 2021-10-21 – 10 Application level DOS at Login Page ( Accepts Long Password ) #1168804 Informative No weakness recorded High 2022-02-07 – 11 [dubmash] Lack of authorization checks - Update Sound Titles Analysed #1102365 Valid Access Control High 2021-10-21 – 21 [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile Analysed #1237428 Valid Denial of Service High 2021-12-13 – 33 GPS metadata preserved when converting HEIF to PNG Analysed #1069039 Valid Information Disclosure High 2021-10-21 – 67 s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh Analysed #1285598 Valid Input Validation and Logic High 2021-10-21 – 96 XSS Reflected on reddit.com via url path Analysed #1051373 Valid Cross-site Scripting High 2022-09-27 – 157 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability Analysed #1658418 Valid Insecure Direct Object Reference High 2022-08-04 $5,000 163 Reflected xss in https://sh.reddit.com Analysed #1549206 Valid Cross-site Scripting High 2022-05-08 $5,000 166 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application. Analysed #1596663 Valid Access Control High 2022-11-14 – 186 Able to approve admin approval and change effective status without adding payment details . Analysed #1543159 Valid Input Validation and Logic High 2022-06-22 $5,000 191 Able to bypass email verification and change email to any other user email Analysed #1551176 Valid Access Control High 2022-05-06 $5,000 200 IDOR allows an attacker to modify the links of any user Analysed #1661113 Valid Insecure Direct Object Reference High 2022-09-30 – 208 XSS via Mod Log Removed Posts Analysed #1504410 Valid Cross-site Scripting High 2022-03-10 – 218 Deleting all DMs on RedditGifts.com Analysed #1213237 Valid Insecure Direct Object Reference High 2021-10-21 $5,000 267 RichText parser vulnerability in scheduled posts allows XSS Analysed #1930763 Valid Cross-site Scripting High 2023-04-20 $5,000 280 Exposed proxy allows to access internal reddit domains Analysed #2967634 Valid Access Control High 2025-02-24 $7,500 296 Blind SSRF to internal services in matrix preview_link API Analysed #1960765 Valid Server-Side Request Forgery High 2023-04-26 $6,000 344 [accounts.reddit.com] Redirect parameter allows for XSS Analysed #1962645 Valid Cross-site Scripting High 2023-05-18 $5,000 394