Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosureAnalysed#1679124	Valid	Access Control	Medium	2022-12-20	–	24
Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_dataAnalysed#1677541	Valid	Access Control	Medium	2022-10-19	–	33
Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443Analysed#1560149	Valid	Access Control	Medium	2022-10-19	–	39
XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tagAnalysed#1823216	Valid	Cross-site Scripting	Medium	2023-05-01	$2,000	46
HTML Injection in the Invoice memos fieldAnalysed#1257767	Valid	Access Control	Medium	2023-03-01	$500	53
CSRF token validation system is disabled on Stripe DashboardAnalysed#1493437	Valid	Cross-Site Request Forgery	Medium	2022-05-31	$2,500	87
User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`Analysed#1328278	Valid	Insecure Direct Object Reference	Medium	2022-01-19	–	100
CSRF token validation system is disabled on Stripe DashboardAnalysed#1483327	Valid	Cross-Site Request Forgery	Medium	2022-04-02	–	113
Possible XSS vulnerability without a content security bypassAnalysed#1804177	Valid	Cross-site Scripting	Medium	2023-05-01	$2,000	131
Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsAnalysed#1849626	Valid	Input Validation and Logic	Medium	2023-02-25	$5,000	266

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.