Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | Command and Code Injection | Critical | 2019-08-10 | $20,160 | 1,246 |
| CRLF injectionAnalysed#446271 | Valid | No weakness recorded | Medium | 2019-12-25 | – | 439 |
| Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040 | Valid | Cross-site Scripting | Critical | 2021-07-09 | – | 357 |
| [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableAnalysed#210779 | Valid | Denial of Service | – | 2019-04-25 | – | 323 |
| Insufficient OAuth callback validation which leads to Periscope account takeoverAnalysed#110293 | Valid | Authentication | – | 2019-04-10 | – | 277 |
| Insufficient validation on Digits bridgeAnalysed#168116 | Valid | Authentication | – | 2020-08-20 | – | 263 |
| XXE on sms-be-vip.twitter.com in SXMP ProcessorAnalysed#248668 | Valid | Injection and Smuggling | Medium | 2017-07-26 | – | 258 |
| XSS and Open Redirect on MoPub LoginAnalysed#683298 | Valid | Open Redirect | – | 2019-09-24 | $1,540 | 248 |
| Periscope android app deeplink leads to CSRF in follow actionAnalysed#583987 | Valid | Cross-Site Request Forgery | Low | 2020-02-21 | $1,540 | 224 |
| Github Account hijack through broken link in developer.twitter.comAnalysed#1031321 | Valid | Input Validation and Logic | High | 2021-02-04 | – | 222 |
| Discoverability by phone number/email restriction bypassAnalysed#1439026 | Valid | Access Control | High | 2022-02-11 | $5,040 | 217 |
| Account Takeover in Periscope TVAnalysed#317476 | Valid | Cross-site Scripting | High | 2018-09-06 | – | 213 |
| Takeover of Twitter-owned domain at mobileapplinking.comAnalysed#321699 | Valid | Input Validation and Logic | None | 2019-02-28 | – | 159 |
| Twitter ID exposure via error-based side-channel attackAnalysed#505424 | Valid | Information Disclosure | Medium | 2019-05-16 | $1,470 | 154 |
| Twitter Periscope Clickjacking VulnerabilityAnalysed#591432 | Valid | Misconfiguration and Insecure Design | Medium | 2019-07-10 | $1,120 | 144 |
| Reflected XSS in twitterflightschool.comAnalysed#770349 | Valid | Cross-site Scripting | None | 2020-02-21 | – | 140 |
| Incorrect param parsing in Digits web authenticationAnalysed#126522 | Valid | Authentication | – | 2018-08-18 | – | 126 |
| XSS via referrer parameterAnalysed#867616 | Valid | Cross-site Scripting | Medium | 2020-10-26 | – | 124 |
| Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileAnalysed#2244229 | Valid | Information Disclosure | Medium | 2024-05-10 | $1,500 | 115 |
| Bypassing Digits web authentication's host validation with HPPAnalysed#114169 | Valid | Authentication | – | 2016-08-12 | – | 108 |
| Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Analysed#470749 | Valid | Input Validation and Logic | Critical | 2019-09-26 | – | 106 |
| Remote Unrestricted file Creation/Deletion and Possible RCE.Analysed#191884 | Valid | Command and Code Injection | Low | 2017-02-26 | – | 100 |
| Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataAnalysed#1369674 | Valid | Cross-site Scripting | Critical | 2022-02-12 | – | 99 |
| Safe Redirect BypassAnalysed#945990 | Valid | Other weaknesses | Low | 2020-09-10 | $560 | 98 |
| Github Token Leaked publicly for https://github.com/mopubAnalysed#612231 | Valid | Cryptography | Medium | 2019-08-15 | – | 92 |
| Bypassing Digits bridge origin validationAnalysed#110467 | Valid | Authentication | – | 2017-04-30 | – | 92 |
| Html Injection and Possible XSS in sms-be-vip.twitter.comAnalysed#150179 | Valid | Cross-site Scripting | – | 2016-08-28 | – | 83 |
| [dev.twitter.com] XSS and Open RedirectAnalysed#260744 | Valid | No weakness recorded | Medium | 2017-09-29 | $1,120 | 75 |
| CSRF on Periscope Web OAuth authorization endpointAnalysed#215381 | Valid | Cross-Site Request Forgery | – | 2017-07-26 | – | 74 |
| Subdomain takeover of images.crossinstall.comAnalysed#1406335 | Valid | Input Validation and Logic | High | 2022-01-05 | – | 71 |
| Protected tweets exposure through the URLAnalysed#491473 | Valid | Information Disclosure | High | 2019-04-19 | $560 | 67 |
| Denial of Service [Chrome]Analysed#921286 | Valid | Denial of Service | Medium | 2020-07-24 | $560 | 66 |
| Multiple DOMXSS on Amplify Web PlayerAnalysed#88719 | Valid | Cross-site Scripting | – | 2017-04-15 | – | 66 |
| Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)Analysed#275518 | Valid | Cross-site Scripting | High | 2018-02-17 | – | 63 |
| HTTP Response Splitting (CRLF injection) in report_storyAnalysed#52042 | Valid | No weakness recorded | – | 2015-04-21 | – | 59 |
| Periscope iOS app CSRF in follow action due to deeplinkAnalysed#805073 | Valid | Cross-Site Request Forgery | Low | 2020-03-31 | $2,940 | 58 |
| NO username used in authenthication to www.mopub.com leading to direct password submission which has unlimited submission rate.Analysed#790854 | Valid | No weakness recorded | Medium | 2020-02-28 | – | 58 |
| Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}Analysed#819930 | Valid | Authentication | Low | 2020-07-10 | $420 | 55 |
| DOM based cookie bombAnalysed#57356 | Valid | Denial of Service | – | 2017-04-11 | – | 55 |
| Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comAnalysed#1073565 | Valid | Open Redirect | Low | 2021-05-04 | – | 53 |
| csp bypass + xssAnalysed#153666 | Valid | Cross-site Scripting | – | 2017-07-05 | – | 51 |
| DOMXSS in TweetdeckAnalysed#119471 | Valid | Cross-site Scripting | – | 2017-04-02 | – | 50 |
| URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWSAnalysed#32825 | Valid | Cross-site Scripting | – | 2014-11-03 | – | 50 |
| Periscope-all Firebase database takeoverAnalysed#684099 | Valid | Access Control | Critical | 2019-09-25 | – | 49 |
| Stealing User emails by clickjacking cards.twitter.com/xxx/xxxAnalysed#154963 | Valid | Misconfiguration and Insecure Design | Medium | 2017-02-03 | – | 49 |
| Opportunity to obtain private tweets through search widget preview cachesAnalysed#263760 | Valid | Input Validation and Logic | – | 2017-11-11 | $1,120 | 48 |
| Bypassing callback_url validation on DigitsAnalysed#108113 | Valid | Open Redirect | – | 2016-08-12 | – | 48 |
| View liked twits of private account via publish.twitter.comAnalysed#174721 | Valid | Information Disclosure | Medium | 2016-11-14 | – | 47 |
| [dev.twitter.com] XSS and Open Redirect Protection BypassAnalysed#330008 | Valid | No weakness recorded | Medium | 2019-02-07 | $1,120 | 46 |
| Cross-site scripting (reflected)Analysed#176754 | Valid | Cross-site Scripting | Medium | 2016-12-09 | – | 45 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.