Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13 TOTP Authenticator implementation Accepts Expired Codes #2588810 Informative Authentication High 2024-07-11 – 19 2FA requirement bypass when claiming bounty #2528919 Informative Input Validation and Logic – 2024-07-11 – 22 2fa can't be activated on app.pullrequest.com #2463069 Informative Misconfiguration and Insecure Design None 2024-07-11 – 25 Session Not Expire / 2FA Bypass #2469706 Informative Authentication Medium 2024-07-11 – 28 2FA Bypass via Leaked Cookies #2479622 Informative Authentication Medium 2024-07-11 – 28 Improper Authentication - 2FA OTP Reusable #2529780 Duplicate Authentication High 2024-07-11 – 31 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Ability to bulk submit reports via query named based batching Analysed #2166697 Valid Misconfiguration and Insecure Design Low 2024-06-19 $500 37 Two-factor authentication bypass lead to information disclosure about the program and all hackers participate #2486086 Duplicate Information Disclosure High 2024-07-11 – 37 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint Analysed #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 LLM03: Training Data Poisoning via ASCII decoding #2370955 Informative Injection and Smuggling None 2024-05-28 – 61 View any user email using the Team's audit log section #2404415 Duplicate Information Disclosure Critical 2024-03-26 – 61 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Takeover of hackerone.engineering via Medium Analysed #2709660 Valid Authentication Low 2024-11-14 – 63 Minor security issue with Hackerone Invitations from sandbox program Analysed #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery #2501984 Informative Authentication Critical 2024-07-11 – 67 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Being able to disclose IBB bounty table of any public program Analysed #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member Analysed #2632876 Valid Access Control Low 2024-12-24 – 77 inviting collaborator using email disclose the hackerone account related to the user Analysed #2045722 Valid Information Disclosure Medium 2024-09-19 – 80 [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery" Analysed #2524939 Valid Information Disclosure Medium 2024-06-11 – 80 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 Possible PII Disclosure via Advanced Vetting Process - ██████ Analysed #2421796 Valid Information Disclosure Medium 2024-05-13 – 82 Program admins could add verified domains to an organization Analysed #2323303 Valid Access Control Low 2024-03-07 – 83 Some limited confidential information can still be accessed after a user exits a private program Analysed #2278865 Valid Information Disclosure Medium 2024-01-19 $50 86 Able to Create Testimonials for myself using Sandbox Analysed #2490953 Valid Access Control Medium 2024-05-22 – 86 Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale Analysed #2476149 Valid No weakness recorded Low 2024-05-09 – 91 An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed Analysed #2040756 Valid Access Control Medium 2024-01-04 – 93 New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report Analysed #2310620 Valid Information Disclosure Medium 2024-03-28 – 97 Creation of bounties through Customer API leads to private email disclosure Analysed #2382120 Valid Information Disclosure Critical 2024-03-26 – 101 Program Member Could Duplicate Report To A Non Related Program Original Report Analysed #2513082 Valid Access Control High 2024-06-19 – 104 Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports Analysed #2516250 Valid Access Control High 2024-06-17 – 109 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 Ability to identify actual private from sandboxed programs using link hackerone.com/$handle/terms_acceptance_data.csv Analysed #2381253 Valid Access Control Medium 2024-06-20 $500 111 Any user could upload attachments to pentest scoping form they don't have access to Analysed #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155