Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| OS Command Execution on User's PC via CSV Injection#282628 | Informative | Command and Code Injection | Medium | 2017-11-02 | – | 2 |
| Reports Modal in app.mopub.com Disclose by any user#574639 | Valid | Information Disclosure | Medium | 2019-10-02 | $280 | 9 |
| Clickjacking Periscope.tv on Chrome#198622 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-06 | $560 | 11 |
| [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME#218451 | Valid | Cross-site Scripting | Medium | 2017-05-08 | – | 11 |
| login csrf in analytics.mopub.com#577920 | Valid | Cross-Site Request Forgery | Medium | 2019-10-02 | $280 | 12 |
| User input validation can lead to DOS#767458 | Valid | Denial of Service | Medium | 2020-03-26 | $560 | 13 |
| SSRF in https://cards-dev.twitter.com/validator#178184 | Valid | Server-Side Request Forgery | Medium | 2017-04-06 | – | 16 |
| PI leakage By Brute Forcing and Phone number deleting without using password#1087525 | Duplicate | Access Control | Medium | 2021-04-22 | – | 16 |
| iOS app crashed by specially crafted direct message reactions#784676 | Valid | Denial of Service | Medium | 2020-02-21 | $560 | 17 |
| Sensitive Information Disclosure https://cards-dev.twitter.com#268888 | Valid | Information Disclosure | Medium | 2017-09-29 | $280 | 19 |
| ms5 debug page exposing internal info (internal IPs, headers)#311326 | Valid | Information Disclosure | Medium | 2018-05-11 | $280 | 19 |
| Improper session handling on web browsers#347748 | Valid | Authentication | Medium | 2018-06-26 | $560 | 19 |
| Stored XSS in https://app.mopub.comAnalysed#642281 | Valid | Cross-site Scripting | Medium | 2019-12-17 | – | 21 |
| lack of input validation that can lead Denial of Service (DOS)Analysed#768677 | Valid | Denial of Service | Medium | 2020-03-12 | $560 | 22 |
| CSRF and probable account takeover on https://www.niche.coAnalysed#493535 | Valid | Cross-Site Request Forgery | Medium | 2019-02-28 | – | 24 |
| Link-shortener bypass (regression on fix for #1032610)Analysed#1421345 | Valid | Other weaknesses | Medium | 2022-12-12 | $560 | 24 |
| cookie injection allow dos attack to periscope.tvAnalysed#583819 | Valid | Denial of Service | Medium | 2019-07-03 | $560 | 26 |
| [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the userAnalysed#712344 | Valid | Input Validation and Logic | Medium | 2021-07-13 | – | 27 |
| Twitter Media Studio Source Information Disclosure With Analyst RoleAnalysed#961757 | Valid | Information Disclosure | Medium | 2020-10-26 | – | 27 |
| Remote 0click exfiltration of Safari user's IP addressAnalysed#1392211 | Valid | Access Control | Medium | 2022-06-15 | $560 | 28 |
| Vine - overwrite account associated with email via android applicationAnalysed#187714 | Valid | Authentication | Medium | 2017-06-14 | $280 | 30 |
| 暴力破解用户密码没有速率控制Analysed#854424 | Valid | Authentication | Medium | 2020-07-01 | – | 30 |
| [staging-engineering.gnip.com] Publicly accessible GIT directoryAnalysed#218465 | Valid | Information Disclosure | Medium | 2018-11-01 | $280 | 33 |
| Accepting error message on twitter sends you to attacker siteAnalysed#781673 | Valid | Open Redirect | Medium | 2020-03-13 | $560 | 33 |
| CSRF on https://www.niche.co leads to "account disconnection"#493552 | Duplicate | Cross-Site Request Forgery | Medium | 2019-03-02 | – | 35 |
| 2 Subdomains Takeover at readfu.comAnalysed#1073114 | Valid | Access Control | Medium | 2021-03-15 | – | 35 |
| Bypass Password Authentication to Update the PasswordAnalysed#982293 | Valid | Authentication | Medium | 2021-02-12 | – | 39 |
| Cross-site scripting (reflected)Analysed#176754 | Valid | Cross-site Scripting | Medium | 2016-12-09 | – | 45 |
| [dev.twitter.com] XSS and Open Redirect Protection BypassAnalysed#330008 | Valid | No weakness recorded | Medium | 2019-02-07 | $1,120 | 46 |
| View liked twits of private account via publish.twitter.comAnalysed#174721 | Valid | Information Disclosure | Medium | 2016-11-14 | – | 47 |
| Stealing User emails by clickjacking cards.twitter.com/xxx/xxxAnalysed#154963 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-03 | – | 49 |
| Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requestsAnalysed#329957 | Valid | Information Disclosure | Medium | 2019-02-08 | $1,120 | 49 |
| Subdomain takeover on dev-admin.periscope.tvAnalysed#531890 | Valid | Access Control | Medium | 2019-05-28 | – | 55 |
| NO username used in authenthication to www.mopub.com leading to direct password submission which has unlimited submission rate.Analysed#790854 | Valid | No weakness recorded | Medium | 2020-02-28 | – | 58 |
| Denial of Service [Chrome]Analysed#921286 | Valid | Denial of Service | Medium | 2020-07-24 | $560 | 66 |
| Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking linksAnalysed#1032610 | Valid | Other weaknesses | Medium | 2022-12-29 | $560 | 70 |
| [dev.twitter.com] XSS and Open RedirectAnalysed#260744 | Valid | No weakness recorded | Medium | 2017-09-29 | $1,120 | 75 |
| Incorrect details on OAuth permissions screen allows DMs to be read without permissionAnalysed#434763 | Valid | Information Disclosure | Medium | 2018-12-14 | $2,940 | 80 |
| Ability to see hidden likesAnalysed#2140960 | Valid | Access Control | Medium | 2024-05-10 | – | 83 |
| Persistent DOM-based XSS in https://help.twitter.com via localStorage#297968 | Valid | Cross-site Scripting | Medium | 2018-02-24 | – | 84 |
| Ability to getting Twitter Blue verified badge without purchase it#1841064 | Duplicate | Input Validation and Logic | Medium | 2024-02-22 | – | 85 |
| Denial of Service | twitter.com & mobile.twitter.comAnalysed#903740 | Valid | Denial of Service | Medium | 2020-09-02 | $1,120 | 89 |
| Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointAnalysed#1694304 | Valid | Access Control | Medium | 2024-03-01 | – | 91 |
| Github Token Leaked publicly for https://github.com/mopubAnalysed#612231 | Valid | Cryptography | Medium | 2019-08-15 | – | 92 |
| Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileAnalysed#2244229 | Valid | Information Disclosure | Medium | 2024-05-10 | $1,500 | 115 |
| XSS via referrer parameterAnalysed#867616 | Valid | Cross-site Scripting | Medium | 2020-10-26 | – | 124 |
| IDOR and statistics leakage in OrdersAnalysed#544329 | Valid | Insecure Direct Object Reference | Medium | 2019-06-14 | $289 | 141 |
| character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorAnalysed#819088 | Valid | Denial of Service | Medium | 2020-05-06 | – | 141 |
| Twitter Periscope Clickjacking VulnerabilityAnalysed#591432 | Valid | Misconfiguration and Insecure Design | Medium | 2019-07-10 | $1,120 | 144 |
| Twitter ID exposure via error-based side-channel attackAnalysed#505424 | Valid | Information Disclosure | Medium | 2019-05-16 | $1,470 | 154 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.