Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152	Valid	Injection and Smuggling	High	2019-08-07	$20,000	2,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737	Valid	Authentication	High	2020-01-08	$15,300	1,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585	Valid	Command and Code Injection	Critical	2021-02-09	$30,000	946
DoS on PayPal via web cache poisoningAnalysed#622122	Valid	Denial of Service	Medium	2019-10-23	$9,700	851
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147	Valid	Injection and Smuggling	High	2019-08-07	$18,900	685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443	Valid	Open Redirect	Medium	2019-02-07	–	188
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835	Valid	Cross-site Scripting	Medium	2020-05-19	–	137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200	Valid	Cross-site Scripting	Medium	2018-11-06	–	100
XSSI on refer.xoom.com allows stealing email addresses and posting to Twitter on behalf of victimAnalysed#450796	Valid	Cross-Site Request Forgery	Medium	2019-02-07	$3,500	81
Reflect XSS and CSP Bypass on https://www.paypal.com/businesswallet/currencyConverter/Analysed#799881	Valid	Cross-site Scripting	Medium	2021-02-10	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.