Take over of accounts created using Google or Facebook Analysed #442901 Valid Cross-Site Request Forgery Critical 2019-05-17 – 184 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation Analysed #3723458 Valid Access Control Critical 2026-06-20 – 126 Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers Analysed #419891 Valid Cross-Site Request Forgery High 2019-06-22 – 111 Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover ) Analysed #3080597 Valid Cryptography Critical 2025-05-07 – 107 Leaked reused password for a few Khan Academy users Analysed #3099978 Valid Cryptography High 2025-07-12 – 92 337k users and 1 employee leaked credentials Analysed #3250691 Valid Information Disclosure High 2025-09-10 – 87 Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag. Analysed #2234420 Valid Misconfiguration and Insecure Design Low 2023-12-22 – 83 Account takeover by changing email Analysed #538800 Valid Cross-Site Request Forgery Critical 2019-05-17 – 80 Enumerate all the class codes via google dorking Analysed #1210043 Valid Access Control High 2021-07-22 – 44 S3 bucket takeover [learn2.khanacademy.org] Analysed #1777077 Valid No weakness recorded High 2022-12-29 – 35 xss due to incorrect handling of postmessages Analysed #1758132 Valid Cross-site Scripting Critical 2022-12-23 – 35 Login page vulnerable to bruteforce attacks via rate limiting bypass Analysed #1040471 Valid Authentication Low 2021-01-09 – 34 Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org Analysed #474798 Valid Access Control High 2019-08-25 – 30 Access to alerta.khanacademy.org leak sensitive data Analysed #1061664 Valid Access Control Critical 2021-09-08 – 29 EMAIL SPOOFING Analysed #496360 Valid Access Control Medium 2022-01-02 – 22 [critical] sql injection by GET method Analysed #319279 Valid SQL Injection High 2018-03-06 – 22 Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked Analysed #1514356 Valid Information Disclosure High 2022-05-01 – 18 POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter Analysed #382321 Valid Cross-site Scripting Medium 2018-09-18 – 16 Bypass the fix of report #1078283 due to poor validation Analysed #1212337 Valid Open Redirect High 2021-07-08 – 14