Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Notification of previous signed out user leakage.#26395 | Informative | Information Disclosure | – | 2014-09-01 | – | 2 |
| Denial of service in report view.#140720 | Informative | Denial of Service | – | 2016-05-27 | – | 2 |
| Pending member invitations are not revoked on program name change#275293 | Informative | Information Disclosure | None | 2017-11-18 | – | 2 |
| Abusing HOF rankings in limited circumstances#118684 | Informative | Misconfiguration and Insecure Design | – | 2016-04-21 | – | 3 |
| Reverse Tabnabbing Vulnerability in Outgoing Links#284143 | Informative | No weakness recorded | Medium | 2017-11-21 | – | 3 |
| (lack of) smtp transport layer security#6547 | Informative | Cryptography | – | 2015-05-05 | – | 4 |
| Arbitrary file uploads to Amazon WS.#7929 | Informative | Misconfiguration and Insecure Design | – | 2014-04-26 | – | 4 |
| Account Hijacking (Only rare case scenario)#21083 | Informative | Authentication | – | 2014-08-23 | – | 4 |
| HackerOne Private Programs users disclosure and de-anonymous-ize#92716 | Informative | Information Disclosure | – | 2015-12-08 | – | 4 |
| Issue with password change in Disabled Account#279914 | Informative | Misconfiguration and Insecure Design | Low | 2017-11-16 | – | 4 |
| No option to logout concurrent sessions#20122 | Informative | No weakness recorded | – | 2014-07-17 | – | 5 |
| Substantially weakened authenticity verification when using 'Remember me for a week'#49357 | Informative | Cryptography | – | 2015-03-12 | – | 5 |
| Possible XSS#123278 | Informative | Cross-site Scripting | – | 2016-04-21 | – | 5 |
| Information Disclosure which violate program privacy#313075 | Informative | Information Disclosure | Low | 2018-02-20 | – | 5 |
| harvesting attack on user registration#2193 | Informative | No weakness recorded | – | 2014-05-19 | – | 6 |
| Flooding mailbox of user#10109 | Informative | Misconfiguration and Insecure Design | – | 2014-04-30 | – | 6 |
| Logical Issue (Boosting Reputation points)#60429 | Informative | No weakness recorded | – | 2015-07-21 | – | 6 |
| Partial disclosure of undisclosed programs through <meta> tags#302620 | Informative | Information Disclosure | – | 2018-01-11 | – | 6 |
| Open redirect deceive in hackerone.com via another open redirect link.#296706 | Informative | Open Redirect | Low | 2017-12-13 | – | 7 |
| Ajouter le même utilisateur que celui déjà inscrit dans les équipes#378209 | Informative | No weakness recorded | – | 2018-07-17 | – | 7 |
| Adding an user email address to the list before confirming.#3923 | Informative | Misconfiguration and Insecure Design | – | 2014-06-11 | – | 8 |
| Email changing#18846 | Informative | No weakness recorded | – | 2014-08-28 | – | 8 |
| Information leakage - Private reports cached by Google#80118 | Informative | Information Disclosure | – | 2018-07-23 | – | 8 |
| Leakage badges on disabled user#325594 | Informative | Information Disclosure | Low | 2018-03-15 | – | 8 |
| "early preview" programs disclosure#29185 | Informative | Information Disclosure | – | 2015-01-21 | – | 9 |
| Session Hijacking attack (Different Scenario)#19640 | Informative | Authentication | – | 2014-07-17 | – | 10 |
| Reward Money Leakage#149435 | Informative | Information Disclosure | – | 2016-08-09 | – | 10 |
| Missing Password Confirmation at a Critical Function (Payout Method)#303299 | Informative | Misconfiguration and Insecure Design | Medium | 2018-01-10 | – | 10 |
| While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)#307424 | Informative | Misconfiguration and Insecure Design | Low | 2018-01-23 | – | 10 |
| Unauthorized Team members viewing#123572 | Informative | Authentication | – | 2016-07-02 | – | 12 |
| Manipulate report timeline activity by using null byte.#133322 | Informative | Misconfiguration and Insecure Design | – | 2016-07-01 | – | 12 |
| Account takeover#17512 | Informative | Authentication | – | 2014-07-17 | – | 16 |
| Submitted reports state logs leakage#306733 | Informative | Information Disclosure | Medium | 2018-01-19 | – | 16 |
| Hackers can reveal the names of private programs that have an external link#1127455 | Informative | Information Disclosure | Low | 2021-08-24 | – | 16 |
| Enumerating HackerOne Pentests#1139541 | Informative | Misconfiguration and Insecure Design | Low | 2021-08-25 | – | 16 |
| Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.#1161141 | Informative | Information Disclosure | Critical | 2021-04-30 | – | 16 |
| Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled#357576 | Informative | Information Disclosure | None | 2018-06-07 | – | 18 |
| TOTP Authenticator implementation Accepts Expired Codes#2588810 | Informative | Authentication | High | 2024-07-11 | – | 19 |
| Enumeration of users#761 | Informative | Misconfiguration and Insecure Design | – | 2014-10-03 | – | 20 |
| 2FA requirement bypass when claiming bounty#2528919 | Informative | Input Validation and Logic | – | 2024-07-11 | – | 22 |
| Login page password-guessing attack#110 | Informative | No weakness recorded | – | 2014-01-16 | – | 23 |
| HackerOne is still prone to Internet Explorer UXSS#108056 | Informative | Cross-Site Request Forgery | – | 2017-04-19 | – | 23 |
| Hackerone Email Addresses Enumeration#2429 | Informative | Information Disclosure | – | 2016-06-17 | – | 24 |
| report id is exposed for undisclosed reports in Hacktivity#493484 | Informative | Information Disclosure | Low | 2019-02-16 | – | 24 |
| 2fa can't be activated on app.pullrequest.com#2463069 | Informative | Misconfiguration and Insecure Design | None | 2024-07-11 | – | 25 |
| Session Not Expire / 2FA Bypass#2469706 | Informative | Authentication | Medium | 2024-07-11 | – | 28 |
| 2FA Bypass via Leaked Cookies#2479622 | Informative | Authentication | Medium | 2024-07-11 | – | 28 |
| Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation#981036 | Informative | Input Validation and Logic | Low | 2021-09-20 | – | 29 |
| Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program#2569993 | Informative | Access Control | Low | 2024-07-11 | – | 32 |
| Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation#2719622 | Informative | No weakness recorded | Medium | 2024-09-19 | – | 33 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.