Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocksAnalysed#4071670	Valid	Authentication	Low	2026-10-08	$200	45
Residual Malicious Payloads on HackerOne after Vulnerability FixesAnalysed#3168691	Valid	Input Validation and Logic	Medium	2026-04-16	–	72
`exportReportPdf` mutation shows internal ActivityAnalysed#3577216	Valid	No weakness recorded	High	2026-07-29	–	92
HackerOne Code sends live password-reset tokens to Segment in automatic page eventsAnalysed#4000185	Valid	Authentication	Low	2026-09-24	$200	115
Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License AbuseAnalysed#3378540	Valid	Access Control	Low	2026-03-18	–	126
Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlAnalysed#3694007	Valid	Command and Code Injection	High	2026-06-17	$7,000	174
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIAnalysed#3287208	Valid	No weakness recorded	–	2026-04-16	–	185
IDOR allows user to access report details via reference.json endpointAnalysed#3862641	Valid	Insecure Direct Object Reference	Critical	2026-10-01	$15,000	372

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.