Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Content Spoofing#1165919	N/A	Input Validation and Logic	Low	2021-10-21	–	1
S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)#1276733	Informative	Access Control	Low	2021-10-21	–	4
No Rate limit on change password leads to account takeover#1165285	Duplicate	Authentication	Low	2021-12-13	–	8
Rate limit is implemented in Reddit , but its not working .#1609004	Duplicate	Authentication	Low	2023-05-18	–	9
registering with the same email address multiple times leads to account takeover#785833	Informative	Authentication	Low	2022-03-14	–	11
[dubsmash] Username and password bruteforceAnalysed#1165225	Valid	Authentication	Low	2021-12-13	–	18
Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`Analysed#1543770	Valid	Input Validation and Logic	Low	2022-07-04	$100	19
No Rate Limit on redditgifts gift when Adding CommentAnalysed#1202408	Valid	Misconfiguration and Insecure Design	Low	2021-10-21	–	25
Unrestricted File Upload on reddit.secure.force.comAnalysed#1606957	Valid	No weakness recorded	Low	2022-09-30	$100	34
Weak rate limit could lead to ATO due to weak password protection mechanismsAnalysed#1065186	Valid	Authentication	Low	2021-12-15	–	39
IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user#2618486	Informative	Insecure Direct Object Reference	Low	2024-08-09	–	47
Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote APIAnalysed#1298902	Valid	Access Control	Low	2021-10-27	–	52

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.