Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152 | Valid | PayPal | Injection and Smuggling | High | 2019-08-07 | $20,000 | 2,687 |
| Account takeover via leaked session cookieAnalysed#745324 | Valid | HackerOne | Authentication | High | 2019-12-03 | $20,000 | 1,642 |
| Github access token exposureAnalysed#1087489 | Valid | Shopify | No weakness recorded | Critical | 2021-07-26 | $50,000 | 1,601 |
| Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737 | Valid | PayPal | Authentication | High | 2020-01-08 | $15,300 | 1,409 |
| RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520 | Valid | Valve | Memory Corruption | Critical | 2019-03-15 | – | 1,289 |
| Potential pre-auth RCE on Twitter VPNAnalysed#591295 | Valid | X / xAI | Command and Code Injection | Critical | 2019-08-10 | $20,160 | 1,246 |
| Exposed Kubernetes API - RCE/Exposed CredsAnalysed#455645 | Valid | Snapchat | Command and Code Injection | Critical | 2021-07-29 | $25,000 | 1,191 |
| Account Takeover via Password Reset without user interactionsAnalysed#2293343 | Valid | GitLab | Access Control | Critical | 2025-02-26 | $35,000 | 989 |
| RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585 | Valid | PayPal | Command and Code Injection | Critical | 2021-02-09 | $30,000 | 946 |
| Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesAnalysed#737140 | Valid | Slack | Injection and Smuggling | Critical | 2020-03-12 | – | 870 |
| DoS on PayPal via web cache poisoningAnalysed#622122 | Valid | PayPal | Denial of Service | Medium | 2019-10-23 | $9,700 | 851 |
| WannaCrypt “Killswitch”Analysed#228648 | Valid | HackerOne | No weakness recorded | – | 2017-05-13 | – | 809 |
| SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseAnalysed#531051 | Valid | Starbucks | SQL Injection | Critical | 2019-08-06 | – | 801 |
| Subdomain Takeover to Authentication bypassAnalysed#335330 | Valid | Roblox | No weakness recorded | Critical | 2020-04-23 | – | 783 |
| JumpCloud API Key leaked via Open Github Repository.Analysed#716292 | Valid | Starbucks | Authentication | Critical | 2019-12-30 | – | 739 |
| SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agentAnalysed#297478 | Valid | GSA Bounty | SQL Injection | Critical | 2019-03-22 | – | 699 |
| Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147 | Valid | PayPal | Injection and Smuggling | High | 2019-08-07 | $18,900 | 685 |
| Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340 | Valid | Uber | Information Disclosure | High | 2019-09-09 | – | 643 |
| Ability to reset password for accountAnalysed#322985 | Valid | Upserve | Access Control | Critical | 2019-06-06 | – | 637 |
| The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentAnalysed#3000510 | Valid | HackerOne | Information Disclosure | Critical | 2025-04-01 | – | 625 |
| Github Token Leaked publicly for https://github.sc-corp.netAnalysed#396467 | Valid | Snapchat | Cryptography | Critical | 2018-10-08 | – | 582 |
| RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Analysed#502758 | Valid | Starbucks | Command and Code Injection | Critical | 2019-04-10 | – | 572 |
| Publicly accessible Continuous Integration ToolAnalysed#313457 | Valid | Snapchat | Access Control | Critical | 2021-07-29 | – | 562 |
| [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureAnalysed#401793 | Valid | Grab | Cross-site Scripting | High | 2019-03-15 | – | 552 |
| Server Side Request Forgery (SSRF) via Analytics ReportsAnalysed#2262382 | Valid | HackerOne | Server-Side Request Forgery | Critical | 2023-12-08 | $25,000 | 529 |
| One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comAnalysed#1567186 | Valid | Access Control | Critical | 2022-08-02 | – | 509 | |
| Able to Become Admin for Any LINE Official AccountAnalysed#698579 | Valid | LY Corporation | Access Control | Critical | 2020-03-25 | – | 493 |
| Reflected XSS in OAUTH2 login flowAnalysed#697099 | Valid | LY Corporation | Cross-site Scripting | Medium | 2020-04-21 | $1,990 | 489 |
| Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationAnalysed#968082 | Valid | TikTok | Cross-site Scripting | High | 2020-11-19 | – | 473 |
| Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`Analysed#684092 | Valid | BlockDev Sp. Z o.o | Input Validation and Logic | Critical | 2019-10-01 | – | 466 |
| Access to multiple production Grafana dashboardsAnalysed#663628 | Valid | Snapchat | Information Disclosure | High | 2020-11-04 | $10,000 | 464 |
| [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813 | Valid | Uber | Information Disclosure | Critical | 2021-02-25 | $40,000 | 458 |
| XSS vulnerable parameter in a location hashAnalysed#146336 | Valid | Slack | Cross-site Scripting | – | 2019-10-16 | – | 455 |
| Reset password link sent over unsecured http protocolAnalysed#1888915 | Valid | Mattermost | Access Control | High | 2023-05-10 | $750 | 440 |
| CRLF injectionAnalysed#446271 | Valid | X / xAI | No weakness recorded | Medium | 2019-12-25 | – | 439 |
| Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781 | Valid | Uber | Authentication | High | 2019-01-25 | – | 427 |
| Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956 | Valid | Valve | Command and Code Injection | Critical | 2019-10-08 | – | 420 |
| Full account takeoverAnalysed#314808 | Valid | Reverb.com | Access Control | High | 2020-03-19 | – | 412 |
| Employee's GitHub Token Found In Travis CI Build LogsAnalysed#496937 | Valid | Superhuman (formerly Grammarly) | Information Disclosure | High | 2019-05-22 | $5,000 | 408 |
| Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerAnalysed#591302 | Valid | Automattic | Denial of Service | Medium | 2020-04-16 | – | 405 |
| [accounts.reddit.com] Redirect parameter allows for XSSAnalysed#1962645 | Valid | Cross-site Scripting | High | 2023-05-18 | $5,000 | 394 | |
| Reflected XSS on www.hackerone.com and resources.hackerone.comAnalysed#840759 | Valid | HackerOne | Cross-site Scripting | Low | 2020-05-05 | $500 | 387 |
| RCE on build server via misconfigured pip installAnalysed#946409 | Valid | Yelp | Supply Chain and Malicious Code | Critical | 2021-02-09 | – | 366 |
| Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Analysed#3782701 | Valid | Mozilla | Command and Code Injection | Critical | 2026-08-05 | $12,000 | 361 |
| HEY.com email stored XSSAnalysed#982291 | Valid | Basecamp | Cross-site Scripting | Critical | 2020-10-27 | $5,000 | 360 |
| Blind XSS on Twitter's internal Big Data panel at █████████████Analysed#1207040 | Valid | X / xAI | Cross-site Scripting | Critical | 2021-07-09 | – | 357 |
| [cs.money] Open Redirect Leads to Account TakeoverAnalysed#905607 | Valid | CS Money | Authentication | Medium | 2020-09-30 | – | 357 |
| Reflected XSS in TikTok endpointsAnalysed#1350887 | Valid | TikTok | Cross-site Scripting | Medium | 2021-10-22 | – | 356 |
| Blind SSRF to internal services in matrix preview_link APIAnalysed#1960765 | Valid | Server-Side Request Forgery | High | 2023-04-26 | $6,000 | 344 | |
| Github information leakedAnalysed#676212 | Valid | Semrush | Information Disclosure | High | 2019-09-25 | – | 344 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.