Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | Command and Code Injection | – | 2019-08-10 | $20,160 | 1,246 |
| CRLF injectionAnalysed#446271 | Valid | No weakness recorded | – | 2019-12-25 | – | 439 |
| Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040 | Valid | Cross-site Scripting | – | 2021-07-09 | – | 357 |
| [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779 | Valid | Denial of Service | – | 2019-04-25 | – | 323 |
| Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293 | Valid | Authentication | – | 2019-04-10 | – | 277 |
| Insufficient validation on Digits bridgeAnalysed#168116 | Valid | Authentication | – | 2020-08-20 | – | 263 |
| XXE on sms-be-vip.twitter.com in SXMP ProcessorAnalysed#248668 | Valid | Injection and Smuggling | – | 2017-07-26 | – | 258 |
| XSS and Open Redirect on MoPub LoginAnalysed#683298 | Valid | Open Redirect | – | 2019-09-24 | $1,540 | 248 |
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | Cross-Site Request Forgery | – | 2020-02-21 | $1,540 | 224 |
| Github Account hijack through broken link in developer.twitter.comAnalysed#1031321 | Valid | Input Validation and Logic | – | 2021-02-04 | – | 222 |
| Discoverability by phone number/email restriction bypassAnalysed#1439026 | Valid | Access Control | – | 2022-02-11 | $5,040 | 217 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | Cross-site Scripting | – | 2018-09-06 | – | 213 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.