Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Reflected XSS on secure.chaturbate.comAnalysed#413412	Valid	Cross-site Scripting	High	2018-10-18	$800	69
Open redirection at https://chaturbate.com/auth/login/Analysed#411723	Valid	Open Redirect	Low	2018-10-22	–	55
CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSSAnalysed#386334	Valid	Cross-site Scripting	High	2018-09-19	–	43
View Failed Approval and Pending videos other usersAnalysed#411679	Valid	No weakness recorded	Low	2018-10-21	$200	28
Open redirect on chaturbate.com (tipping/purchase_success)Analysed#413426	Valid	Open Redirect	Low	2018-10-25	$250	26
Form Replay in customer information formAnalysed#411620	Valid	Authentication	Medium	2019-01-11	–	16
No rate limit in stats api token endpointAnalysed#412526	Valid	Authentication	Low	2018-10-19	–	15
Login form on non-HTTPS page on http://stream.highwebmedia.com/auth/login/Analysed#386735	Valid	Cryptography	Low	2018-09-20	–	15
[chatws25.stream.highwebmedia.com] - Reflected XSS in c parameterAnalysed#413442	Valid	Cross-site Scripting	Medium	2018-09-26	$350	13
Users may still able to view chat room panel of password protected roomsAnalysed#386351	Valid	Access Control	Medium	2018-09-20	–	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.