The return of the ＜ Analysed #639684 Valid Cross-site Scripting High 2019-09-24 $1,000 576 XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker) Analysed #220852 Valid Cross-site Scripting Medium 2021-06-03 – 194 Access to the business emails of Rockstar Support agents through the support platform Analysed #1920908 Valid Access Control Low 2025-10-02 $550 151 Stored XSS in Snapmatic + R★Editor comments Analysed #309531 Valid Cross-site Scripting High 2018-04-19 – 118 Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft. Analysed #787160 Valid Cross-Site Request Forgery Medium 2020-06-24 – 112 Password and mail address stored unencrypted in memory - Rockstar Game Launcher Analysed #1128357 Valid Cryptography Medium 2023-10-27 $750 91 Blind SSRF in emblem editor (2) Analysed #265050 Valid Server-Side Request Forgery Medium 2017-10-28 $1,500 83 LFI and SSRF via XXE in emblem editor Analysed #347139 Valid Injection and Smuggling Critical 2018-08-01 $1,500 79 Facebook OAuth Code Theft through referer leakage on support.rockstargames.com Analysed #482743 Valid Cross-Site Request Forgery Medium 2019-02-19 – 71 Ticket Trick Attack allows access to ████████' workspaces Analysed #1534465 Valid Access Control High 2026-09-01 – 66 Unquoted Service Path in "Rockstar Game Library Service" Analysed #716448 Valid Access Control Medium 2019-12-02 – 60 Social Club Account Takeover Via RGL And Steam/Epic Linked Account Analysed #1235008 Valid Access Control High 2021-11-17 – 53 SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE Analysed #288353 Valid Server-Side Request Forgery High 2018-01-12 $1,500 52 Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend Analysed #1442783 Valid Authentication High 2023-07-05 $750 51 Stored XSS on support.rockstargames.com Analysed #265384 Valid Cross-site Scripting Medium 2017-10-10 $1,000 49 Stored XSS in profile activity feed messages Analysed #231444 Valid Cross-site Scripting Medium 2017-08-28 $1,000 45 <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information -> Analysed #204292 Valid Cross-Site Request Forgery Critical 2017-05-24 – 39 Stored XSS on profile page via Steam display name Analysed #282604 Valid Cross-site Scripting High 2017-11-10 $1,250 35 Stored XSS in snapmatic comments Analysed #231389 Valid Cross-site Scripting Medium 2017-09-05 $1,000 30 Uninstalling Rockstar Games Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication Analysed #1278261 Valid Information Disclosure Low 2022-04-07 $250 28