Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Account Takeover via Unverified Email Change and Improper Session HandlingAnalysed#3324823 | Valid | U.S. Dept Of Defense | Misconfiguration and Insecure Design | High | 2026-01-12 | – | 16 |
| Weak Forgot Password implementationAnalysed#176116 | Valid | Revive Adserver | Authentication | Low | 2017-08-02 | – | 17 |
| Broken Authentication & Session Management (Login Bypass) at support.owox.comAnalysed#222082 | Valid | OWOX, Inc. | Authentication | Critical | 2017-05-22 | – | 17 |
| CSRF log victim into the attacker accountAnalysed#293016 | Valid | Unikrn | Cross-Site Request Forgery | High | 2018-04-10 | – | 17 |
| old session dose not expire after password changeAnalysed#1166076 | Valid | UPchieve | No weakness recorded | None | 2021-08-31 | – | 17 |
| HTTP header injection in info.hackerone.com allows setting cookies for hackerone.comAnalysed#97292 | Valid | HackerOne | No weakness recorded | – | 2015-12-02 | – | 18 |
| Uninstalling Slack for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#238260 | Valid | Slack | Authentication | Low | 2020-11-10 | $500 | 18 |
| Failure to Invalid Session after Password ChangeAnalysed#514577 | Valid | Omise | Authentication | Medium | 2019-12-08 | – | 18 |
| Improper session handling on web browsersAnalysed#347748 | Valid | X / xAI | Authentication | Medium | 2018-06-26 | $560 | 19 |
| Web Server Predictable Session ID on EdgeSwitchAnalysed#774393 | Valid | Ubiquiti Inc. | Authentication | High | 2021-05-23 | – | 19 |
| Session fixation in password protected public download.Analysed#237184 | Valid | Nextcloud | Authentication | Low | 2018-10-25 | – | 20 |
| Intercom chat session information persists after logoutAnalysed#249798 | Valid | Legal Robot | Authentication | Low | 2017-07-18 | – | 20 |
| Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#1797661 | Valid | Mattermost | Authentication | Low | 2023-01-14 | – | 20 |
| [REMOTE] Full Account Takeover At https://██████████████/CAS/Analysed#215859 | Valid | U.S. Dept Of Defense | Input Validation and Logic | High | 2019-10-04 | – | 21 |
| Session Hijacking leads to full control of account by attackerAnalysed#1201396 | Valid | UPchieve | No weakness recorded | None | 2021-06-24 | – | 21 |
| Disconnecting an external login provider does not revoke sessionAnalysed#1547684 | Valid | Shopify | Authentication | Medium | 2022-12-01 | $1,600 | 21 |
| Session not expired on logoutAnalysed#353 | Valid | HackerOne | No weakness recorded | – | 2014-04-19 | $100 | 22 |
| Session fixation on public talk linksAnalysed#1181962 | Valid | Nextcloud | Authentication | Medium | 2021-06-16 | $100 | 23 |
| Cloudflare is not properly deleting user's accountAnalysed#1728292 | Valid | Cloudflare Public Bug Bounty | Input Validation and Logic | Medium | 2023-04-13 | – | 23 |
| Improper session managementAnalysed#737 | Valid | HackerOne | Authentication | – | 2014-02-19 | $100 | 24 |
| Login form on non-HTTPS pageAnalysed#214571 | Valid | Rockstar Games | Cryptography | High | 2017-04-26 | $350 | 24 |
| Improper Authentication via previous backup code loginAnalysed#1485788 | Valid | Basecamp | Authentication | Medium | 2022-03-24 | – | 24 |
| SAML Response Reuse on hackerone.com/users/saml/authAnalysed#888930 | Valid | HackerOne | Authentication | Low | 2020-07-24 | – | 26 |
| CVE-2023-40273: Session fixation in Apache Airflow web interfaceAnalysed#2121960 | Valid | Internet Bug Bounty | Authentication | Low | 2023-09-04 | $540 | 26 |
| Switching the user to the attacker's accountAnalysed#727 | Valid | HackerOne | Cross-Site Request Forgery | – | 2014-02-20 | $150 | 27 |
| CVE-2022-27779: cookie for trailing dot TLDAnalysed#1565615 | Valid | Internet Bug Bounty | Information Disclosure | Medium | 2022-06-11 | – | 27 |
| Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authenticationAnalysed#1278261 | Valid | Rockstar Games | Information Disclosure | Low | 2022-04-07 | $250 | 28 |
| XML‑RPC login leak exposes valid session ID enabling unauthorized API accessAnalysed#3783738 | Valid | Revive Adserver | Access Control | Medium | 2026-06-25 | – | 28 |
| Being able to change account contents even after password changeAnalysed#662108 | Valid | Kartpay | Authentication | Medium | 2021-01-06 | – | 32 |
| Bybass The Closing of the account and logged again to your accountAnalysed#167489 | Valid | Yelp | Authentication | – | 2016-10-21 | – | 34 |
| 2FA Session not expires after the password resetAnalysed#486693 | Valid | Nextcloud | Authentication | Medium | 2021-01-18 | $50 | 35 |
| Broken Authentication Session Token BugAnalysed#948345 | Valid | Courier | Authentication | Medium | 2022-02-16 | – | 35 |
| Broken Authentication and session management OWASP A2Analysed#284 | Valid | HackerOne | Authentication | – | 2014-01-09 | – | 36 |
| Improper Session management can cause account takeover[https://micropurchase.18f.gov]Analysed#263873 | Valid | GSA Bounty | Authentication | Medium | 2019-07-30 | – | 36 |
| [m.airbnb.com] CRLF InjectionAnalysed#197279 | Valid | Airbnb | Injection and Smuggling | Low | 2018-04-03 | $2,500 | 37 |
| CVE-2026-7168: cross-proxy Digest auth state leakAnalysed#3697719 | Valid | curl | Information Disclosure | Medium | 2026-04-29 | – | 37 |
| Lack of session expiration after password reset on TikTok Careers PortalAnalysed#997127 | Valid | TikTok | Authentication | Low | 2021-03-03 | $50 | 38 |
| [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthAnalysed#3321406 | Valid | Cloudflare Public Bug Bounty | No weakness recorded | High | 2026-04-14 | – | 39 |
| Stored XSS in attachment-display exploitable through SameSiteAnalysed#3594137 | Valid | Nextcloud | Cross-site Scripting | Medium | 2026-04-19 | – | 39 |
| Account takeover via XSSAnalysed#735638 | Valid | Rocket.Chat | Cross-site Scripting | Critical | 2021-03-31 | – | 41 |
| Changing the administrator password via admin console does not invalidate other sessionsAnalysed#2279041 | Valid | PortSwigger Web Security | Authentication | Low | 2024-05-20 | – | 41 |
| Broken Authentication and Session Management Flaw After Change Password and LogoutAnalysed#634488 | Valid | Omise | Misconfiguration and Insecure Design | Low | 2020-11-08 | – | 45 |
| Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesAnalysed#895727 | Valid | Ruby on Rails | Input Validation and Logic | Low | 2020-06-16 | – | 46 |
| Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query sessionAnalysed#417382 | Valid | HackerOne | Authentication | Low | 2018-11-30 | $500 | 47 |
| session takeover via open protocol redirection on streamlabs.comAnalysed#1178239 | Valid | Logitech | Open Redirect | Medium | 2021-09-01 | $200 | 50 |
| Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)Analysed#3101207 | Valid | Dust | Authentication | Medium | 2025-04-29 | – | 56 |
| Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliAnalysed#3073507 | Valid | Internet Bug Bounty | Authentication | Low | 2025-05-29 | – | 57 |
| Insufficient session expiration in the **com.shopify.ping** android appAnalysed#1172205 | Valid | Shopify | Authentication | Low | 2021-11-26 | – | 63 |
| [Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthAnalysed#3423950 | Valid | Cloudflare Public Bug Bounty | Cross-site Scripting | High | 2026-04-14 | – | 63 |
| Two-factor authentication enforcement bypassAnalysed#1050244 | Valid | Nextcloud | No weakness recorded | High | 2021-07-31 | $750 | 64 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.