Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tvAnalysed#452559	Valid	Access Control	High	2019-07-10	–	76
Downloading password protected / restricted videosAnalysed#145467	Valid	No weakness recorded	–	2016-09-05	–	43
All Vimeo Private videos disclosure via Authorization BypassAnalysed#137502	Valid	Information Disclosure	–	2016-07-29	–	35
Make API calls on behalf of another user (CSRF protection bypass)Analysed#44146	Valid	Cross-Site Request Forgery	–	2015-01-22	–	33
OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingAnalysed#136582	Valid	Cross-Site Request Forgery	–	2017-10-18	–	32
Disclosure of sensitive information through Google Cloud Storage bucketAnalysed#176013	Valid	Information Disclosure	High	2017-09-29	–	27
Images and Subtitles Leakage from private videosAnalysed#136850	Valid	Information Disclosure	–	2017-10-18	–	17
CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicAnalysed#136481	Valid	Cross-Site Request Forgery	–	2016-07-29	–	15
URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.ioAnalysed#49663	Valid	Cross-Site Request Forgery	–	2015-04-18	–	14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.