Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)#1276733	Informative	Access Control	Low	2021-10-21	–	4
Broken links make users from France unable to understand the allowed content policy#1461207	Informative	No weakness recorded	None	2023-05-18	–	6
Regular Expression Denial of Service vulnerability#1538157	Informative	Denial of Service	Medium	2022-04-12	–	6
hardcoded api secret & api key in com.reddit.frontpage#1241116	Informative	Authentication	Critical	2021-10-21	–	8
Open Redirect through POST Request in www.redditinc.com#1310230	Informative	Open Redirect	Medium	2022-07-08	–	10
registering with the same email address multiple times leads to account takeover#785833	Informative	Authentication	Low	2022-03-14	–	11
Application level DOS at Login Page ( Accepts Long Password )#1168804	Informative	No weakness recorded	High	2022-02-07	–	11
HTML injection in API response including request url#1719588	Informative	File and Path Handling	Critical	2023-05-18	–	11
oauth misconfigration lead to account takeover#1815463	Informative	Access Control	–	2023-05-18	–	11
api keys leaked#1762927	Informative	Access Control	Medium	2022-11-10	–	16
Misconfigurated login page able to lock login action for any account without user interaction#1582778	Informative	No weakness recorded	Critical	2022-06-06	–	19
Can use the Reddit android app as usual even though revoking the access of it from reddit.com#1632186	Informative	Authentication	Critical	2022-07-16	–	20
IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user#2618486	Informative	Insecure Direct Object Reference	Low	2024-08-09	–	47

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.