Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Account takeover via leaked session cookieAnalysed#745324	Valid	Authentication	–	2019-12-03	$20,000	1,642
WannaCrypt “Killswitch”Analysed#228648	Valid	No weakness recorded	–	2017-05-13	–	809
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510	Valid	Information Disclosure	Critical	2025-04-01	–	625
Server Side Request Forgery (SSRF) via Analytics ReportsAnalysed#2262382	Valid	Server-Side Request Forgery	–	2023-12-08	$25,000	529
Reflected XSS on www.hackerone.com and resources.hackerone.comAnalysed#840759	Valid	Cross-site Scripting	–	2020-05-05	$500	387
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`Analysed#1618347	Valid	No weakness recorded	Critical	2025-01-21	$25,000	295
View Titles of Private Reports with pending email invitationAnalysed#2312029	Valid	Access Control	–	2024-01-16	–	257
Denial of service via cache poisoningAnalysed#409370	Valid	Denial of Service	–	2018-12-22	$2,500	253
Cross-site Scripting (XSS) on HackerOne careers pageAnalysed#474656	Valid	Cross-site Scripting	–	2019-02-17	$500	239
Reflected XSS on www.hackerone.com via Wistia embed codeAnalysed#986386	Valid	Cross-site Scripting	–	2020-09-24	$500	236

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.