Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS in developer.uber.comAnalysed#131450	Valid	Cross-site Scripting	–	2016-06-27	$7,500	223
uber.com may RCE by Flask Jinja2 Template InjectionAnalysed#125980	Valid	Command and Code Injection	–	2016-04-06	$10,000	137
Client secret, server tokens for developer applications returned by internal APIAnalysed#419655	Valid	Information Disclosure	–	2019-02-08	–	125
Stored XSS on any page in most Uber domainsAnalysed#217739	Valid	Cross-site Scripting	–	2018-11-20	$6,000	107
private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") eventsAnalysed#174404	Valid	Information Disclosure	–	2021-05-14	–	91
Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceAnalysed#574638	Valid	Input Validation and Logic	Medium	2019-07-18	–	82
Changing paymentProfileUuid when booking a trip allows free ridesAnalysed#162809	Valid	Cross-Site Request Forgery	–	2016-09-15	–	73
Lack of payment type validation in dial.uber.com allows for free ridesAnalysed#162199	Valid	Input Validation and Logic	–	2018-11-20	–	68

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.