Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Legacy API exposes private video titles#111386	Valid	Information Disclosure	–	2016-02-10	–	1
No Limitation on Following allows user to follow people automatically!#43846	Valid	Cross-Site Request Forgery	–	2016-05-02	–	2
Private, embeddable videos leaks data through Facebook & Open Graph#121919	Valid	Information Disclosure	–	2016-05-21	–	3
Missing rate limit on private videos password#124564	Valid	Access Control	–	2016-03-22	–	3
XSS in Subtitles of Vimeo Flash Player and Hubnut#137023	Duplicate	Cross-site Scripting	–	2016-09-14	–	4
Invite any user to your group without even following him#52707	Valid	Access Control	–	2016-08-25	–	6
Error page Text Injection.#130914	Duplicate	Misconfiguration and Insecure Design	–	2016-08-02	–	6
[vimeopro.com] CRLF Injection#39181	Valid	No weakness recorded	–	2016-10-24	–	10
CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public#136481	Valid	Cross-Site Request Forgery	–	2016-07-29	–	15
All Vimeo Private videos disclosure via Authorization BypassAnalysed#137502	Valid	Information Disclosure	–	2016-07-29	–	35
Downloading password protected / restricted videosAnalysed#145467	Valid	No weakness recorded	–	2016-09-05	–	43

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.