[dubsmash] Username and password bruteforce #1165225 Valid Authentication – 2021-12-13 – 18 Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations` #1543770 Valid Input Validation and Logic – 2022-07-04 $100 19 Domain Takeover of Reddit.ru via DNS Hijacking #1226891 Valid Access Control – 2021-10-21 $500 20 [dubmash] Lack of authorization checks - Update Sound Titles #1102365 Valid Access Control – 2021-10-21 – 21 Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753 #1285081 Valid Open Redirect – 2022-09-30 – 21 No Rate Limit on redditgifts gift when Adding Comment #1202408 Valid Misconfiguration and Insecure Design – 2021-10-21 – 25 Third party app could steal access token as well as protected files using inAppBrowser #1122177 Valid Information Disclosure – 2021-10-27 – 32 [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile #1237428 Valid Denial of Service – 2021-12-13 – 33 Unrestricted File Upload on reddit.secure.force.com #1606957 Valid No weakness recorded – 2022-09-30 $100 34 Weak rate limit could lead to ATO due to weak password protection mechanisms #1065186 Valid Authentication – 2021-12-15 – 39 Open Redirect on www.redditinc.com via `failed` query param #1257753 Valid Open Redirect – 2022-09-22 – 41 Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase #801743 Valid Race Conditions – 2021-10-27 – 42 IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter #1213765 Valid Input Validation and Logic – 2021-10-21 $500 42 Hash-Collision Denial-of-Service Vulnerability in Markdown Parser #1341957 Valid Denial of Service – 2021-10-21 – 44 CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit ! #1480569 Valid Cross-Site Request Forgery – 2022-06-16 – 47 Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API #1298902 Valid Access Control – 2021-10-27 – 52 Image queue default key of 'None' and GraphQL unhandled type exception #996041 Valid Memory Corruption – 2021-10-27 $500 65 GPS metadata preserved when converting HEIF to PNG #1069039 Valid Information Disclosure – 2021-10-21 – 67 Reddit talk promotion offers don't expire, allowing users to accept them after being demoted #1656380 Valid Insecure Direct Object Reference – 2022-10-03 – 72 s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.sh #1285598 Valid Input Validation and Logic – 2021-10-21 – 96 Regression on dest parameter sanitization doesn't check scheme/websafe destinations #1962951 Valid Cross-site Scripting – 2023-06-03 $500 101 XSS Reflected on reddit.com via url path #1051373 Valid Cross-site Scripting – 2022-09-27 – 157 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability #1658418 Valid Insecure Direct Object Reference – 2022-08-04 $5,000 163 Reflected xss in https://sh.reddit.com Analysed #1549206 Valid Cross-site Scripting – 2022-05-08 $5,000 166 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application. Analysed #1596663 Valid Access Control – 2022-11-14 – 186 Able to approve admin approval and change effective status without adding payment details . Analysed #1543159 Valid Input Validation and Logic – 2022-06-22 $5,000 191 Able to bypass email verification and change email to any other user email Analysed #1551176 Valid Access Control – 2022-05-06 $5,000 200 IDOR allows an attacker to modify the links of any user Analysed #1661113 Valid Insecure Direct Object Reference – 2022-09-30 – 208 XSS via Mod Log Removed Posts Analysed #1504410 Valid Cross-site Scripting – 2022-03-10 – 218 Deleting all DMs on RedditGifts.com Analysed #1213237 Valid Insecure Direct Object Reference – 2021-10-21 $5,000 267 RichText parser vulnerability in scheduled posts allows XSS Analysed #1930763 Valid Cross-site Scripting – 2023-04-20 $5,000 280 Exposed proxy allows to access internal reddit domains Analysed #2967634 Valid Access Control High 2025-02-24 $7,500 296 Blind SSRF to internal services in matrix preview_link API Analysed #1960765 Valid Server-Side Request Forgery – 2023-04-26 $6,000 344 [accounts.reddit.com] Redirect parameter allows for XSS Analysed #1962645 Valid Cross-site Scripting – 2023-05-18 $5,000 394 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com Analysed #1567186 Valid Access Control – 2022-08-02 – 509