Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | Valid | SQL Injection | Critical | 2025-01-08 | – | 115 |
| IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUserAnalysed#1714638 | Valid | Access Control | Critical | 2024-09-18 | – | 96 |
| Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointAnalysed#2746709 | Valid | No weakness recorded | High | 2025-03-02 | – | 76 |
| Broken Access Control(Horizontal Privilege Escalation).Analysed#2319586 | Valid | Access Control | Medium | 2025-01-31 | – | 69 |
| Insecure direct Object Reference(Horizontal Escalation)Analysed#2322663 | Valid | Insecure Direct Object Reference | Medium | 2025-01-31 | – | 66 |
| No rate limit in OTP code sendingAnalysed#1780399 | Valid | No weakness recorded | Medium | 2024-10-21 | – | 49 |
| IDOR Leads To Account Takeover Without User InteractionAnalysed#1272478 | Valid | Insecure Direct Object Reference | Critical | 2022-09-04 | – | 34 |
| IDOR [mtnmobad.mtnbusiness.com.ng]Analysed#1698006 | Valid | No weakness recorded | Critical | 2022-10-13 | – | 28 |
| Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information DisclosureAnalysed#1448550 | Valid | Insecure Direct Object Reference | Critical | 2022-12-01 | – | 28 |
| Email verification bypassed during sing up (████████)Analysed#1182016 | Valid | Misconfiguration and Insecure Design | Medium | 2021-08-19 | – | 20 |
| Password reset token leak on third party website via Referer header [██████████]Analysed#1320242 | Valid | No weakness recorded | Medium | 2022-09-01 | – | 13 |
| No rate limit lead to otp brute forcingAnalysed#1060541 | Valid | Authentication | High | 2021-08-16 | – | 13 |
| Remote code execution due to unvalidated file uploadAnalysed#1164452 | Valid | Input Validation and Logic | Critical | 2022-09-01 | – | 12 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.