Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
No Password Length Restriction leads to Denial of Service#1243009	Duplicate	Denial of Service	None	2021-10-21	–	2
com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)#1325649	Duplicate	Input Validation and Logic	Medium	2021-12-13	–	2
No Rate limit on change password leads to account takeover#1165285	Duplicate	Authentication	Low	2021-12-13	–	8
Huge amount of Subdomains Takeovers at Reddit.com#1966262	Duplicate	Access Control	Medium	2023-05-18	–	8
User Account has been taken out#1195340	Duplicate	Authentication	Critical	2021-10-21	–	9
Rate limit is implemented in Reddit , but its not working .#1609004	Duplicate	Authentication	Low	2023-05-18	–	9
No rate limit leads to spaming post#1206004	Duplicate	Authentication	Medium	2023-05-18	–	11
Missing rate limit in current password change settings leads to Account takeover#1170522	Duplicate	Authentication	Medium	2021-10-27	–	13
Oauth Misconfiguration Lead To Account Takeover#1212374	Duplicate	Access Control	Medium	2021-10-21	–	21
Infromation Disclosure To Use of Hard-coded Cryptographic Key#2353237	Duplicate	Cryptography	Medium	2024-02-06	–	238

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.