Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717 | Valid | Authentication | – | 2016-07-14 | – | 312 |
| SQL Injection on sctrack.email.uber.com.cnAnalysed#150156 | Valid | SQL Injection | – | 2016-07-25 | $4,000 | 93 |
| OneLogin authentication bypass on WordPress sites via XMLRPCAnalysed#138869 | Valid | Command and Code Injection | – | 2016-07-15 | $7,000 | 83 |
| Subdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontAnalysed#175070 | Valid | Access Control | – | 2016-12-12 | – | 69 |
| xss in https://www.uber.comAnalysed#145278 | Valid | Cross-site Scripting | – | 2016-07-25 | – | 64 |
| OneLogin authentication bypass on WordPress sitesAnalysed#136169 | Valid | Authentication | – | 2016-06-06 | $10,000 | 58 |
| Blind OOB XXE At "http://ubermovement.com/"Analysed#154096 | Valid | Command and Code Injection | – | 2016-08-08 | $500 | 56 |
| Stored XSS on developer.uber.com via admin account compromiseAnalysed#152067 | Valid | Cross-site Scripting | – | 2016-08-12 | $5,000 | 37 |
| Stealing users password (Limited Scenario)Analysed#163067 | Valid | Misconfiguration and Insecure Design | – | 2016-09-29 | – | 35 |
| Reflected XSS on developer.uber.com via Angular template injectionAnalysed#125027 | Valid | Cross-site Scripting | – | 2016-04-04 | $3,000 | 35 |
| CBC "cut and paste" attack may cause Open Redirect(even XSS)Analysed#126203 | Valid | Cryptography | – | 2016-08-12 | $500 | 22 |
| Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.comAnalysed#149679 | Valid | Access Control | – | 2016-07-25 | – | 21 |
| XSS @ love.uber.comAnalysed#117068 | Valid | Cross-site Scripting | – | 2016-05-07 | – | 21 |
| Stored XSS on newsroom.uber.com admin panel / Stream WordPress pluginAnalysed#127948 | Valid | Cross-site Scripting | – | 2016-07-27 | $5,000 | 18 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.