Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Opportunity to post hidden comments#434202 | Informative | Input Validation and Logic | Critical | 2018-12-11 | – | 2 |
| Global defaming of any twitter user#434689 | N/A | Input Validation and Logic | Critical | 2018-12-06 | – | 3 |
| Improper Host Detection During Team Up on tweetdeck.twitter.comAnalysed#294867 | Valid | No weakness recorded | – | 2018-01-04 | – | 19 |
| No Rate Limit in email leads to huge Mass mailingsAnalysed#297359 | Valid | Input Validation and Logic | Low | 2018-06-01 | – | 19 |
| ms5 debug page exposing internal info (internal IPs, headers)Analysed#311326 | Valid | Information Disclosure | Medium | 2018-05-11 | $280 | 19 |
| Improper session handling on web browsersAnalysed#347748 | Valid | Authentication | Medium | 2018-06-26 | $560 | 19 |
| CVE-2017-15277 on Profile pageAnalysed#315906 | Valid | Information Disclosure | Low | 2018-03-08 | – | 23 |
| [sms-be-vip.twitter.com] vulnerable to JetleakAnalysed#143935 | Valid | Information Disclosure | – | 2018-04-02 | $1,260 | 28 |
| POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)Analysed#288966 | Valid | Cryptography | – | 2018-02-22 | – | 28 |
| CORS misconfig | Account TakeoverAnalysed#426147 | Valid | No weakness recorded | High | 2018-12-10 | – | 30 |
| [staging-engineering.gnip.com] Publicly accessible GIT directoryAnalysed#218465 | Valid | Information Disclosure | Medium | 2018-11-01 | $280 | 33 |
| Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)Analysed#99600 | Valid | Authentication | High | 2018-03-21 | – | 39 |
| Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)Analysed#275518 | Valid | Cross-site Scripting | High | 2018-02-17 | – | 63 |
| Incorrect details on OAuth permissions screen allows DMs to be read without permissionAnalysed#434763 | Valid | Information Disclosure | Medium | 2018-12-14 | $2,940 | 80 |
| Persistent DOM-based XSS in https://help.twitter.com via localStorage#297968 | Valid | Cross-site Scripting | Medium | 2018-02-24 | – | 84 |
| Incorrect param parsing in Digits web authenticationAnalysed#126522 | Valid | Authentication | – | 2018-08-18 | – | 126 |
| Highly wormable clickjacking in player cardAnalysed#85624 | Valid | Misconfiguration and Insecure Design | – | 2018-05-17 | – | 134 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | Cross-site Scripting | High | 2018-09-06 | – | 213 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.