Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
| CSRF in crashlytics.com#13856 | Valid | Cross-Site Request Forgery | – | 2014-09-08 | – | 1 |
| Captcha bypass with extension at http://www.mopub.com/about/contact/#15047 | Informative | Cryptography | – | 2014-09-22 | – | 1 |
| password sent over HTTP#20081 | Valid | Cryptography | – | 2014-08-05 | – | 1 |
| Missing Rate Limiting on https://twitter.com/account/complete#27166 | Valid | Information Disclosure | – | 2014-11-10 | – | 1 |
| Twitter Flight SSL 2.0 deprecated protocol vulnerability.#29206 | Valid | Cryptography | – | 2014-10-07 | – | 1 |
| XSS platform.twitter.com | video-js metadata#29360 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 1 |
| Options Method Enabled#33987 | Informative | No weakness recorded | – | 2014-12-26 | – | 1 |
| Bad extended ascii handling in HTTP 301 redirects of t.co#34084 | Valid | Open Redirect | – | 2015-08-09 | – | 1 |
| POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com#41240 | Valid | Cryptography | – | 2015-09-20 | $140 | 1 |
| No rate limiting on creating lists#42250 | Informative | Misconfiguration and Insecure Design | – | 2015-01-06 | – | 1 |
| Path disclosure in platform0.twitter.com#44371 | Informative | Information Disclosure | – | 2015-02-20 | – | 1 |
| open redirect sends authenticity_token to any website or (ip address)#50752 | Valid | Open Redirect | – | 2015-03-14 | $560 | 1 |
| Following a User Actually Follows Another User#95243 | Valid | Open Redirect | – | 2015-12-02 | $280 | 1 |
| Following a User After Favoriting Actually Follows Another User (related to #95243)#97510 | Valid | Misconfiguration and Insecure Design | – | 2015-12-02 | $280 | 1 |
| XSS vulnerability in video player page#15125 | Valid | Cross-site Scripting | – | 2014-08-02 | – | 2 |
| Cookie not marked as secure.#15232 | Valid | No weakness recorded | – | 2014-08-04 | – | 2 |
| Full path disclosure at ads.twitter.com#26825 | Valid | Information Disclosure | – | 2014-11-17 | $140 | 2 |
| Unauthorized Tweeting on behalf of Account Owners#31082 | Valid | Misconfiguration and Insecure Design | – | 2015-05-07 | $420 | 2 |
| Creating Unauthorized Audience Lists#31188 | Informative | Misconfiguration and Insecure Design | – | 2014-11-28 | – | 2 |
| BROKEN AUTHENTICATION IN MOBILE VERIFICATION#33432 | Informative | Misconfiguration and Insecure Design | – | 2014-12-14 | – | 2 |
| Option Method Enabled on web server#33986 | Informative | No weakness recorded | – | 2014-12-25 | – | 2 |
| [Stored XSS] vine.co - profile page#36986 | Valid | Cross-site Scripting | – | 2015-03-26 | – | 2 |
| Homograph attack.#37108 | Informative | Misconfiguration and Insecure Design | – | 2015-01-01 | – | 2 |
| twitter android app Fragment Injection#43988 | Valid | Command and Code Injection | – | 2015-04-11 | – | 2 |
| URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ.#44578 | Valid | Command and Code Injection | – | 2015-02-21 | – | 2 |
| Privacy Issue on protected tweets#55506 | Informative | Authentication | – | 2015-05-14 | – | 2 |
| OS Command Execution on User's PC via CSV Injection#282628 | Informative | Command and Code Injection | – | 2017-11-02 | – | 2 |
| Opportunity to post hidden comments#434202 | Informative | Input Validation and Logic | – | 2018-12-11 | – | 2 |
| Token remains alive ever after logging out!#14177 | Informative | Authentication | – | 2014-11-17 | – | 3 |
| uclfinal.twitter.com and euro2012.twitter.com are vulnerable to CRIME attack#14199 | Informative | Cryptography | – | 2014-08-16 | – | 3 |
| User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)#23913 | Valid | No weakness recorded | – | 2015-02-25 | – | 3 |
| XSS platform.twitter.com#29328 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 3 |
| XSS in fabric.io#32519 | Valid | Cross-site Scripting | – | 2014-12-23 | – | 3 |
| DOM Cross-Site Scripting ( XSS )#33091 | Valid | Cross-site Scripting | – | 2014-12-03 | $1,400 | 3 |
| Flaw in valid password policy.#33331 | Informative | Authentication | – | 2014-11-30 | – | 3 |
| Headers Missing#36053 | Informative | Misconfiguration and Insecure Design | – | 2014-11-15 | – | 3 |
| Abuse of "Remember Me" functionality.#37822 | Informative | Authentication | – | 2014-12-29 | – | 3 |
| Open redirection in fabric.io#39631 | Valid | Open Redirect | – | 2014-12-18 | $280 | 3 |
| Fabric.io - an app admin can delete team members from other user apps#43065 | Valid | Access Control | – | 2015-03-09 | $1,120 | 3 |
| Twitter Card - Parent Window Redirection#46818 | Valid | Cross-site Scripting | – | 2015-05-04 | $560 | 3 |
| Redirect URL in /intent/ functionality is not properly escaped#48516 | Valid | Cross-site Scripting | – | 2015-02-24 | – | 3 |
| Privecy Issue : view "Protected users" followers and following#56119 | Informative | Authentication | – | 2015-05-15 | – | 3 |
| Can see private tweets via keyword searches on tweetdeck#97161 | Valid | Access Control | – | 2016-02-16 | – | 3 |
| Full Path Disclosure at 27.prd.vine.co#175451 | Valid | No weakness recorded | – | 2016-10-21 | $140 | 3 |
| Global defaming of any twitter user#434689 | N/A | Input Validation and Logic | – | 2018-12-06 | – | 3 |
| XSS ON MOPUB.COM#15356 | Valid | Cross-site Scripting | – | 2014-08-15 | – | 4 |
| Password reset link not validated.#22012 | Informative | Denial of Service | – | 2014-08-31 | – | 4 |
| ads.twitter.com xss#27511 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 4 |
| Stored xss#27846 | Valid | Cross-site Scripting | – | 2014-09-27 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.