Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186	Valid	Access Control	Critical	2022-08-02	–	509
[accounts.reddit.com] Redirect parameter allows for XSSAnalysed#1962645	Valid	Cross-site Scripting	High	2023-05-18	$5,000	394
Blind SSRF to internal services in matrix preview_link APIAnalysed#1960765	Valid	Server-Side Request Forgery	High	2023-04-26	$6,000	344
Exposed proxy allows to access internal reddit domainsAnalysed#2967634	Valid	Access Control	High	2025-02-24	$7,500	296
Reflected xss in https://sh.reddit.comAnalysed#1549206	Valid	Cross-site Scripting	High	2022-05-08	$5,000	166
XSS Reflected on reddit.com via url pathAnalysed#1051373	Valid	Cross-site Scripting	High	2022-09-27	–	157
Regression on dest parameter sanitization doesn't check scheme/websafe destinationsAnalysed#1962951	Valid	Cross-site Scripting	Medium	2023-06-03	$500	101
s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shAnalysed#1285598	Valid	Input Validation and Logic	High	2021-10-21	–	96
CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !Analysed#1480569	Valid	Cross-Site Request Forgery	Medium	2022-06-16	–	47
Open Redirect on www.redditinc.com via `failed` query paramAnalysed#1257753	Valid	Open Redirect	Medium	2022-09-22	–	41
Weak rate limit could lead to ATO due to weak password protection mechanismsAnalysed#1065186	Valid	Authentication	Low	2021-12-15	–	39
Unrestricted File Upload on reddit.secure.force.comAnalysed#1606957	Valid	No weakness recorded	Low	2022-09-30	$100	34
No Rate Limit on redditgifts gift when Adding CommentAnalysed#1202408	Valid	Misconfiguration and Insecure Design	Low	2021-10-21	–	25

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.