Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Ability to DOS any organization's SSO and open up the door to account takeoversAnalysed#976603	Valid	Authentication	High	2021-04-15	$10,500	260
Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originAnalysed#389108	Valid	No weakness recorded	Critical	2019-08-01	–	202
Previously created sessions continue being valid after MFA activationAnalysed#667739	Valid	Access Control	Medium	2019-08-19	–	176
Lack of CSRF header validation at https://g-mail.grammarly.com/profileAnalysed#629892	Valid	Information Disclosure	Medium	2019-10-31	–	140
Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)Analysed#535436	Valid	Access Control	High	2020-01-04	$800	134
Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)Analysed#462416	Valid	Information Disclosure	Low	2019-06-03	–	84
“email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredAnalysed#665722	Valid	Authentication	Medium	2019-08-12	$2,500	82
`open-url` command allows opening unlimited number of tabs pointing to arbitrary URLsAnalysed#389076	Valid	No weakness recorded	Medium	2019-04-23	–	37
Permissive CORS policy trusting arbitrary extensions originAnalysed#412490	Valid	Access Control	Medium	2019-11-06	$500	33
"More on Wikipedia" link disclose "Referrer" and leak `window.opener` reference for arbitrary websitesAnalysed#409518	Valid	Misconfiguration and Insecure Design	Low	2019-04-30	–	29

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.