Several Subdomains Takeover #1591085 N/A No weakness recorded High 2022-06-08 – 2 sensitive data exposure #1716249 N/A Information Disclosure High 2022-11-10 – 5 Regular Expression Denial of Service vulnerability #1538157 Informative Denial of Service Medium 2022-04-12 – 6 XSS in redditmedia.com can compromise data of reddit.com #862882 N/A Cross-site Scripting Medium 2022-08-03 – 10 Open Redirect through POST Request in www.redditinc.com #1310230 Informative Open Redirect Medium 2022-07-08 – 10 registering with the same email address multiple times leads to account takeover #785833 Informative Authentication Low 2022-03-14 – 11 Application level DOS at Login Page ( Accepts Long Password ) #1168804 Informative No weakness recorded High 2022-02-07 – 11 api keys leaked #1762927 Informative Access Control Medium 2022-11-10 – 16 Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations` Analysed #1543770 Valid Input Validation and Logic Low 2022-07-04 $100 19 Misconfigurated login page able to lock login action for any account without user interaction #1582778 Informative No weakness recorded Critical 2022-06-06 – 19 Can use the Reddit android app as usual even though revoking the access of it from reddit.com #1632186 Informative Authentication Critical 2022-07-16 – 20 Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753 Analysed #1285081 Valid Open Redirect Medium 2022-09-30 – 21 Unrestricted File Upload on reddit.secure.force.com Analysed #1606957 Valid No weakness recorded Low 2022-09-30 $100 34 Open Redirect on www.redditinc.com via `failed` query param Analysed #1257753 Valid Open Redirect Medium 2022-09-22 – 41 CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit ! Analysed #1480569 Valid Cross-Site Request Forgery Medium 2022-06-16 – 47 Reddit talk promotion offers don't expire, allowing users to accept them after being demoted Analysed #1656380 Valid Insecure Direct Object Reference Medium 2022-10-03 – 72 XSS Reflected on reddit.com via url path Analysed #1051373 Valid Cross-site Scripting High 2022-09-27 – 157 Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability Analysed #1658418 Valid Insecure Direct Object Reference High 2022-08-04 $5,000 163 Reflected xss in https://sh.reddit.com Analysed #1549206 Valid Cross-site Scripting High 2022-05-08 $5,000 166 Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application. Analysed #1596663 Valid Access Control High 2022-11-14 – 186 Able to approve admin approval and change effective status without adding payment details . Analysed #1543159 Valid Input Validation and Logic High 2022-06-22 $5,000 191 Able to bypass email verification and change email to any other user email Analysed #1551176 Valid Access Control High 2022-05-06 $5,000 200 IDOR allows an attacker to modify the links of any user Analysed #1661113 Valid Insecure Direct Object Reference High 2022-09-30 – 208 XSS via Mod Log Removed Posts Analysed #1504410 Valid Cross-site Scripting High 2022-03-10 – 218 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com Analysed #1567186 Valid Access Control Critical 2022-08-02 – 509