Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Email Verification Bypass Allows Users to Add & verify Any Email As Guardians EmailAnalysed#1636552 | Valid | Access Control | High | 2022-12-17 | – | 42 |
| Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset EndpointAnalysed#3987499 | Valid | Denial of Service | High | 2026-10-05 | – | 32 |
| Client Side string length checkAnalysed#1244798 | Valid | Input Validation and Logic | Medium | 2023-10-14 | – | 25 |
| Information can be changed without a passwordAnalysed#721341 | Valid | Authentication | High | 2020-03-14 | – | 24 |
| The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack.Analysed#1293377 | Valid | Input Validation and Logic | Medium | 2022-03-22 | – | 17 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.