Markdown parsing issue enables insertion of malicious tags and event handlers Analysed #299728 Valid Cross-site Scripting – 2018-01-29 $5,000 184 IDOR Vulnerability at AddTagToAssets operation name Analysed #2633771 Valid Insecure Direct Object Reference Medium 2025-06-08 – 178 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure – 2019-12-01 – 178 Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars Analysed #815085 Valid Misconfiguration and Insecure Design – 2024-02-04 $3,750 176 Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql Analysed #3694007 Valid Command and Code Injection High 2026-06-17 $7,000 174 SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter Analysed #435066 Valid SQL Injection – 2018-11-30 – 174 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure – 2020-05-16 – 173 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure – 2020-02-28 $500 168 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference – 2019-04-23 – 161 Web Authentication Endpoint Credentials Brute-Force Vulnerability Analysed #127844 Valid Authentication – 2016-06-23 – 161 LLM01: Invisible Prompt Injection Analysed #2372363 Valid Injection and Smuggling Medium 2024-05-13 – 159 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting – 2018-11-27 $2,500 156 Hackerone supports accounts organitation takeover Analysed #2798380 Valid No weakness recorded Medium 2024-11-19 $2,500 155 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic – 2019-04-05 – 154 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design – 2016-09-20 – 154 Race Condition leads to undeletable group member Analysed #604534 Valid Race Conditions – 2020-03-20 – 153 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid Misconfiguration and Insecure Design – 2017-08-29 – 153 Banned user still has access to their deleted account via HackerOne's API using their API key Analysed #1577940 Valid Access Control Medium 2025-07-14 – 150 [ Spot Check ] Team members can edit a user's write-up Analysed #2530242 Valid Access Control Low 2024-06-06 – 149 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery – 2021-07-07 $2,500 149 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure – 2019-04-24 $3,000 147 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting – 2021-06-24 – 146 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure – 2020-09-10 $2,500 146 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication – 2018-03-25 – 145 Blind SSRF on errors.hackerone.net due to Sentry misconfiguration Analysed #374737 Valid Server-Side Request Forgery – 2018-07-04 $3,500 143 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure – 2020-02-10 $2,500 142 Server Side Request Forgery (SSRF) in webhook functionality Analysed #2301565 Valid Server-Side Request Forgery Medium 2024-01-30 $2,500 140 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure – 2017-02-24 – 140 Bypassing HackerOne 2FA due to race condition Analysed #2598548 Valid Input Validation and Logic Medium 2024-10-30 – 139 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Payload delivery via Social Media urls on H1 profile Analysed #2483422 Valid File and Path Handling Medium 2024-07-23 – 138 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure – 2019-10-21 $2,500 138 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control – 2017-03-27 – 134 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded – 2021-08-24 $2,500 130 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting – 2018-08-04 – 129 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure – 2019-11-08 – 127 Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse Analysed #3378540 Valid Access Control Low 2026-03-18 – 126 Race Conditions in Popular reports feature. Analysed #146845 Valid Memory Corruption – 2016-08-03 – 125 Ability to access policy and updates for unauthorized program Analysed #2965723 Valid Access Control Medium 2025-05-08 – 124 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget #1598347 Valid Cross-site Scripting – 2023-03-10 – 122 Any user could upload attachments to pentest scoping form they don't have access to #2450215 Valid Input Validation and Logic High 2024-05-15 – 121 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ #1285115 Valid Information Disclosure – 2021-11-08 – 118 Internal Gitlab Ticket Disclosure via External Slack Channels #1273292 Valid Information Disclosure – 2021-08-04 – 118 Account recovery text message is sending a wrong domain to users. #549364 Valid Input Validation and Logic – 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. #397792 Valid Input Validation and Logic – 2019-01-02 – 117 HackerOne Code sends live password-reset tokens to Segment in automatic page events #4000185 Valid Authentication Low 2026-09-24 $200 115 Emails of invited collaborators are disclosed in full in payload for report participants #269230 Valid Information Disclosure – 2019-04-09 – 112