Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Program	Weakness	Severity	Disclosed	Bounty	Votes
Vulnerability Name: Host Header Injection RedirectAnalysed#601287	Valid	WakaTime	Open Redirect	Low	2019-09-02	–	14
XSS via X-Forwarded-Host headerAnalysed#882220	Valid	U.S. Dept Of Defense	Cross-site Scripting	Medium	2021-05-11	–	16
Host Header Injection/Redirection in: https://www.instacart.com/Analysed#158019	Valid	Instacart	Open Redirect	–	2016-09-11	–	17
Host header injection/redirection via newsletter signupAnalysed#229498	Valid	Starbucks	No weakness recorded	Low	2018-06-08	–	19
Host Header Injection on https://███/████████/Account/ForgotPasswordAnalysed#1679969	Valid	U.S. Dept Of Defense	Input Validation and Logic	Medium	2022-10-14	–	19
Internal Hostname disclosure from multiple Apache servers via blank host header methodAnalysed#548094	Valid	Ping Identity	Information Disclosure	Low	2020-03-12	$150	21
TLS Virtual Host ConfusionAnalysed#501	Valid	Internet Bug Bounty	No weakness recorded	–	2014-11-10	–	23
use of unsafe host header leads to open redirectAnalysed#210875	Valid	Rockstar Games	Misconfiguration and Insecure Design	Low	2017-05-01	–	23
Password Reset link hijacking via Host Header Poisoning leads to account takeoverAnalysed#1108874	Valid	U.S. Dept Of Defense	Access Control	Critical	2021-04-02	–	23
Host Header InjectionAnalysed#1098948	Valid	Kartpay	Injection and Smuggling	Medium	2021-05-10	–	27
Modify Host Header which is sent to emailAnalysed#791293	Valid	Endless Group	Command and Code Injection	High	2020-02-12	–	30
Information / sensitive data disclosure on some endpointsAnalysed#273726	Valid	WordPress	Information Disclosure	Medium	2018-08-22	–	32
Subdomain Takeover via Host Header Injection on www.█████Analysed#2188240	Valid	U.S. Dept Of Defense	Misconfiguration and Insecure Design	Critical	2024-06-18	–	35
Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofingAnalysed#1072277	Valid	Logitech	Input Validation and Logic	High	2021-01-07	–	37
App messaging can be hijacked by third-party websitesAnalysed#387279	Valid	Shopify	Misconfiguration and Insecure Design	Medium	2018-11-07	–	39
Web cache poisoning leads to disclosure of CSRF token and sensitive informationAnalysed#504514	Valid	Smule	Misconfiguration and Insecure Design	Medium	2019-07-21	–	39
DNS Cache PoisoningAnalysed#487	Valid	HackerOne	No weakness recorded	–	2014-01-09	$100	41
Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.Analysed#1444675	Valid	Omise	No weakness recorded	Medium	2022-04-09	$300	50
Password reset link injection allows redirect to malicious URLAnalysed#281575	Valid	Mavenlink	No weakness recorded	High	2017-12-13	–	62
XSS via X-Forwarded-Host headerAnalysed#1392935	Valid	Omise	Cross-site Scripting	Medium	2022-01-29	$200	65
Host Header Injection - internal.qa.delivery.indrive.comAnalysed#2076786	Valid	inDrive	No weakness recorded	Low	2024-02-12	–	66
Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blogAnalysed#977851	Valid	Shopify	Injection and Smuggling	Low	2020-09-11	$1,000	67
Password Reset link hijacking via Host Header PoisoningAnalysed#226659	Valid	Concrete CMS	Access Control	None	2017-06-06	–	73
Host Header AttacAnalysed#2627221	Valid	RubyGems	No weakness recorded	Medium	2025-02-08	–	74
https://themes.shopify.com::: Host header web cache poisoning lead to DoSAnalysed#1096609	Valid	Shopify	Denial of Service	Medium	2021-04-08	$2,900	82
Defacement of catalog.data.gov via web cache poisoning to stored DOMXSSAnalysed#303730	Valid	GSA Bounty	Cross-site Scripting	High	2018-11-01	$750	93
Hacker.One Subdomain TakeoverAnalysed#159156	Valid	HackerOne	Misconfiguration and Insecure Design	Low	2016-09-20	–	154
HTTP Request Smuggling on https://labs.data.govAnalysed#726773	Valid	GSA Bounty	Injection and Smuggling	High	2020-05-13	$750	160
Account Takeover in Periscope TVAnalysed#317476	Valid	X / xAI	Cross-site Scripting	High	2018-09-06	–	213
Denial of service via cache poisoningAnalysed#409370	Valid	HackerOne	Denial of Service	Medium	2018-12-22	$2,500	253

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.