Account takeover via leaked session cookie Analysed #745324 Valid Authentication – 2019-12-03 $20,000 1,642 WannaCrypt “Killswitch” Analysed #228648 Valid No weakness recorded – 2017-05-13 – 809 The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present Analysed #3000510 Valid Information Disclosure Critical 2025-04-01 – 625 Server Side Request Forgery (SSRF) via Analytics Reports Analysed #2262382 Valid Server-Side Request Forgery Critical 2023-12-08 $25,000 529 Reflected XSS on www.hackerone.com and resources.hackerone.com Analysed #840759 Valid Cross-site Scripting – 2020-05-05 $500 387 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}` Analysed #1618347 Valid No weakness recorded Critical 2025-01-21 $25,000 295 View Titles of Private Reports with pending email invitation Analysed #2312029 Valid Access Control High 2024-01-16 – 257 Denial of service via cache poisoning Analysed #409370 Valid Denial of Service – 2018-12-22 $2,500 253 Cross-site Scripting (XSS) on HackerOne careers page Analysed #474656 Valid Cross-site Scripting – 2019-02-17 $500 239 Reflected XSS on www.hackerone.com via Wistia embed code Analysed #986386 Valid Cross-site Scripting – 2020-09-24 $500 236 HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization Analysed #2101076 Valid Memory Corruption High 2024-02-04 – 228 Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack Analysed #1181946 Valid Denial of Service Medium 2021-12-22 – 228 Internal Access to Hackerone confluence Docs Analysed #3113398 Valid Misconfiguration and Insecure Design High 2025-08-15 $12,500 227 Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information Analysed #2937622 Valid Information Disclosure Medium 2025-05-31 – 226 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid Cross-site Scripting – 2019-02-21 $500 208 2020-10-09 Credential Stuffing Attack Analysed #1007689 Valid No weakness recorded – 2020-10-13 – 196 Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos Analysed #1034257 Valid Misconfiguration and Insecure Design – 2021-03-25 – 194 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure – 2020-06-05 – 189 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure – 2019-12-01 – 178 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars Analysed #815085 Valid Misconfiguration and Insecure Design – 2024-02-04 $3,750 176 SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter Analysed #435066 Valid SQL Injection – 2018-11-30 – 174 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure – 2020-05-16 – 173 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure – 2020-02-28 $500 168 Web Authentication Endpoint Credentials Brute-Force Vulnerability Analysed #127844 Valid Authentication – 2016-06-23 – 161 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic – 2019-04-05 – 154 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design – 2016-09-20 – 154 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid Misconfiguration and Insecure Design – 2017-08-29 – 153 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure – 2020-09-10 $2,500 146 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication – 2018-03-25 – 145 Blind SSRF on errors.hackerone.net due to Sentry misconfiguration Analysed #374737 Valid Server-Side Request Forgery – 2018-07-04 $3,500 143 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure – 2020-02-10 $2,500 142 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure – 2019-10-21 $2,500 138 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting – 2018-08-04 – 129 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 HackerOne Code sends live password-reset tokens to Segment in automatic page events Analysed #4000185 Valid Authentication Low 2026-09-24 $200 115 [IDOR] Improper Access Control on Embedded Submission Form Analysed #2483666 Valid Insecure Direct Object Reference Low 2024-06-19 $2,500 110 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure – 2020-07-25 $2,500 107 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting – 2019-05-04 – 106