Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverAnalysed#1883806	Valid	Misconfiguration and Insecure Design	Medium	2023-08-23	–	90
Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account TakeoverAnalysed#397497	Valid	Cross-site Scripting	Medium	2021-02-25	$3,000	52
Reflected XSS on multiple uberinternal.com domainsAnalysed#326449	Valid	Cross-site Scripting	Medium	2018-11-13	$2,000	41
CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.comAnalysed#1257100	Valid	File and Path Handling	Medium	2021-08-05	–	39
Reflected XSS in lert.uber.comAnalysed#191810	Valid	Cross-site Scripting	Medium	2018-12-19	–	39
Reflected XSS on https://www.uber.comAnalysed#708081	Valid	Cross-site Scripting	Medium	2021-02-24	$1,000	37
phone number exposure for riders/drivers given email/uuidAnalysed#225243	Valid	Information Disclosure	Medium	2017-06-02	–	36
Reflected XSS POST method at partners.uber.comAnalysed#129582	Valid	Cross-site Scripting	Medium	2019-01-25	$3,000	31
Full read SSRF in flyte-poc-us-east4.uberinternal.comAnalysed#1540906	Valid	Server-Side Request Forgery	Medium	2022-05-26	$2,000	30
Subdomain takeover on mta1a1.spmail.uber.comAnalysed#707748	Valid	Access Control	Medium	2020-04-06	–	30
4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )Analysed#1116545	Valid	Access Control	Medium	2021-04-29	$500	29
SQLI on desafio5estrelas.comAnalysed#476150	Valid	SQL Injection	Medium	2021-03-29	$2,500	29
Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root passwordAnalysed#365199	Valid	No weakness recorded	Medium	2018-08-27	$1,000	29
Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilitiesAnalysed#323899	Valid	Cross-Site Request Forgery	Medium	2021-02-25	$500	29
Cleartext password exposure allows access to the desafio5estrelas.com admin panelAnalysed#344566	Valid	Cryptography	Medium	2021-03-30	$500	20
Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/Analysed#354686	Valid	Cross-site Scripting	Medium	2018-11-13	$500	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.