Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Can see phone numbers of others by providing mail addressAnalysed#2534458	Valid	Information Disclosure	High	2024-11-13	–	111
IDOR to make someone attend or leave an eventAnalysed#1734639	Valid	Insecure Direct Object Reference	Medium	2026-03-06	–	87
Forced OAuth authorization using button ID in hash and holding spaceAnalysed#2649615	Valid	Authentication	Medium	2024-12-17	–	79
Employee-only Area BypassAnalysed#2299571	Valid	Access Control	Medium	2024-02-19	–	77
CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*Analysed#1964211	Valid	Cross-Site Request Forgery	Medium	2023-12-06	–	53
Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`Analysed#1813450	Valid	Insecure Direct Object Reference	Medium	2023-05-12	–	44
Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewedAnalysed#1837309	Valid	Insecure Direct Object Reference	Medium	2023-05-17	–	43
bypass two-factor authentication.Analysed#1842183	Valid	Authentication	Medium	2023-08-01	–	41

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.