Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Logout CSRF#244778 | Duplicate | Cross-Site Request Forgery | Low | 2017-08-29 | – | – |
| HTML - injection#245233 | N/A | No weakness recorded | – | 2021-10-12 | – | 1 |
| Sensitive Cookie Without 'HttpOnly' Flag#245514 | Informative | No weakness recorded | None | 2017-07-03 | – | 3 |
| Running 2 accounts with a single email#246302 | Informative | Input Validation and Logic | – | 2017-07-06 | – | 3 |
| Failure to check password history#255034 | N/A | Authentication | Low | 2017-07-30 | – | 3 |
| Validation of Password reset tokens#273560 | Informative | Misconfiguration and Insecure Design | Low | 2017-10-01 | – | 3 |
| Rate Limit too lenient for endpoint sending emails#658089 | Valid | Authentication | None | 2020-08-19 | – | 3 |
| [invalid][false-positive] csrftoken on profile page#675398 | N/A | Misconfiguration and Insecure Design | – | 2019-08-20 | – | 3 |
| Unsafe Inline and Eval CSP Usage#244724 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-24 | – | 4 |
| SSH backdated version open port#255627 | Valid | Authentication | None | 2017-11-23 | – | 4 |
| password token validation#275242 | Informative | Authentication | Low | 2017-10-07 | – | 4 |
| Can link to websites from profile#275245 | Informative | Authentication | Low | 2017-10-07 | – | 4 |
| Session not expired on logout#245124 | Duplicate | Authentication | – | 2017-07-03 | – | 5 |
| Missing Account Deletion Notification#245311 | Valid | No weakness recorded | – | 2017-07-03 | – | 5 |
| Session Duplication due to Broken Access Control#247225 | Duplicate | Access Control | High | 2017-07-10 | – | 5 |
| UI Redressing on Embedded Charts#244697 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-05 | – | 6 |
| https://wakatime.com/ website CSP "script-src" includes "unsafe-inline"#244766 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-24 | – | 6 |
| Login page password - guessing attack#244909 | Informative | Authentication | Low | 2017-07-01 | – | 6 |
| No rate limit on creating private leaderboards.#245527 | Valid | No weakness recorded | – | 2017-07-18 | – | 6 |
| Private leaderboard owner email disclosure when sending invites#969988 | Valid | Information Disclosure | – | 2020-08-28 | – | 6 |
| Password token validation in https://wakatime.com/#244614 | Valid | Authentication | Low | 2017-07-24 | – | 7 |
| Forgot password link doesn't expire after used, only after some hours#244642 | Valid | Authentication | Low | 2017-07-03 | – | 7 |
| Session Not Expired On Logout#244875 | Duplicate | Authentication | – | 2017-07-01 | – | 7 |
| No notificatoin sent on email after account deletion.#244971 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-03 | – | 7 |
| Missing filteration of meta characters in all full name field on wakatime.com#245236 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-04 | – | 7 |
| Blocking users to sign up on the site#245538 | Valid | Misconfiguration and Insecure Design | None | 2017-07-08 | – | 7 |
| Broken Authentication and session management OWASP A2#798812 | N/A | Authentication | – | 2020-02-19 | – | 7 |
| Clickjacking on authorized page https://wakatime.com/share/embed#244967 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-05 | – | 8 |
| No rate limiting for confirmation email, can spam anyone with confirmation emails#245147 | Valid | Misconfiguration and Insecure Design | – | 2017-07-03 | – | 8 |
| Bypassing Access control, changing owner's name in a private leaderboard#245340 | Valid | Access Control | Medium | 2017-07-31 | – | 8 |
| Impersonation of Wakatime user using Invitation functionality.#257119 | Valid | Misconfiguration and Insecure Design | – | 2017-08-06 | – | 8 |
| Mailgun misconfiguration#244474 | Valid | Access Control | – | 2017-07-01 | – | 9 |
| Users with member privilege are able to see emails and membership information of other users#244781 | Valid | Information Disclosure | Medium | 2017-09-25 | – | 9 |
| No redirect uri for Twitter Oath resulting in token leak#244958 | Valid | Authentication | Low | 2017-07-03 | – | 9 |
| Lack of Password Confirmation When Changing Email#245334 | Valid | Misconfiguration and Insecure Design | – | 2017-07-03 | – | 9 |
| [wakatime.com] HTML Injection github-btn.html#248588 | Valid | Cross-site Scripting | Low | 2018-10-19 | – | 9 |
| Missing SPF Flags#244432 | Valid | Misconfiguration and Insecure Design | Low | 2017-07-01 | – | 10 |
| Leaking password reset token via referrer from external Twitter share button#244434 | Valid | Information Disclosure | – | 2017-07-03 | – | 10 |
| No rate limit when creating new goals [https://wakatime.com/goals]#244813 | Valid | Misconfiguration and Insecure Design | – | 2017-07-03 | – | 10 |
| Two email addresses can access the same account#245305 | Valid | Misconfiguration and Insecure Design | – | 2017-07-03 | – | 10 |
| Using an outdated version of OpenSSH on db01.wakatime.com#246780 | Valid | Information Disclosure | Low | 2017-10-29 | – | 11 |
| Password reset links should expire after being used, instead of at specific time#244612 | Valid | Authentication | Medium | 2017-07-23 | – | 12 |
| [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector]#246419 | Valid | Access Control | Medium | 2017-08-10 | – | 12 |
| by pass rate limit exceed#246838 | Valid | Access Control | – | 2017-07-10 | – | 12 |
| Email Spoofing Via /api/v1/users/reset_passwordAnalysed#244555 | Valid | No weakness recorded | – | 2017-07-01 | – | 14 |
| [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledgeAnalysed#244567 | Valid | Access Control | Medium | 2017-08-10 | – | 14 |
| Password Policy IssueAnalysed#246042 | Valid | Authentication | Low | 2017-07-06 | – | 14 |
| Vulnerability Name: Host Header Injection RedirectAnalysed#601287 | Valid | Open Redirect | Low | 2019-09-02 | – | 14 |
| IDOR create accounts and verify them with original account emailAnalysed#244636 | Valid | Insecure Direct Object Reference | Low | 2017-07-03 | – | 15 |
| Add arbitrary content to Password Reset EmailAnalysed#244677 | Valid | Command and Code Injection | – | 2017-07-20 | – | 24 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.