Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Delete direct message history without access the proper conversation_idAnalysed#666632 | Valid | Input Validation and Logic | Low | 2020-11-20 | $560 | 33 |
| [staging-engineering.gnip.com] Publicly accessible GIT directoryAnalysed#218465 | Valid | Information Disclosure | Medium | 2018-11-01 | $280 | 33 |
| Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506Analysed#906433 | Valid | Cross-site Scripting | High | 2020-09-24 | $560 | 32 |
| Reset password without knowing current passwordAnalysed#806055 | Valid | Authentication | Low | 2020-03-25 | – | 32 |
| CRLF and XSS stored on ton.twitter.comAnalysed#191380 | Valid | Cross-site Scripting | – | 2017-07-05 | $1,680 | 32 |
| [Critical] - Steal OAuth TokensAnalysed#131202 | Valid | Authentication | – | 2016-07-11 | – | 31 |
| Identify the mobile number of a twitter userAnalysed#1225164 | Valid | Information Disclosure | Critical | 2022-03-29 | $560 | 30 |
| 暴力破解用户密码没有速率控制Analysed#854424 | Valid | Authentication | Medium | 2020-07-01 | – | 30 |
| CORS misconfig | Account TakeoverAnalysed#426147 | Valid | No weakness recorded | High | 2018-12-10 | – | 30 |
| HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameterAnalysed#221328 | Valid | Information Disclosure | Low | 2017-05-08 | – | 30 |
| GNIP subdomain take overAnalysed#189548 | Valid | No weakness recorded | High | 2017-02-06 | – | 30 |
| Vine - overwrite account associated with email via android applicationAnalysed#187714 | Valid | Authentication | Medium | 2017-06-14 | $280 | 30 |
| HTTP Response Splitting (CRLF injection) due to headers overflowAnalysed#53843 | Valid | No weakness recorded | – | 2015-05-04 | – | 30 |
| Remote 0click exfiltration of Safari user's IP addressAnalysed#1392211 | Valid | Access Control | Medium | 2022-06-15 | $560 | 28 |
| The Deleted Polls is Still Accessable after 30 DaysAnalysed#1015373 | Valid | Information Disclosure | High | 2023-02-13 | $560 | 28 |
| POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)Analysed#288966 | Valid | Cryptography | – | 2018-02-22 | – | 28 |
| [sms-be-vip.twitter.com] vulnerable to JetleakAnalysed#143935 | Valid | Information Disclosure | – | 2018-04-02 | $1,260 | 28 |
| Twitter Media Studio Source Information Disclosure With Analyst RoleAnalysed#961757 | Valid | Information Disclosure | Medium | 2020-10-26 | – | 27 |
| [Bypass fixed #664038 and #519059] Application settings change settings that have been set by the userAnalysed#712344 | Valid | Input Validation and Logic | Medium | 2021-07-13 | – | 27 |
| Information Exposure Through Directory Listing vulnerability on 8 vcache**.usw2.snappytv.com websitesAnalysed#438299 | Valid | Information Disclosure | Low | 2019-02-11 | – | 27 |
| Information Disclosure through .DS_Store in ██████████Analysed#142549 | Valid | Information Disclosure | – | 2016-12-12 | $560 | 27 |
| cookie injection allow dos attack to periscope.tvAnalysed#583819 | Valid | Denial of Service | Medium | 2019-07-03 | $560 | 26 |
| Link-shortener bypass (regression on fix for #1032610)Analysed#1421345 | Valid | Other weaknesses | Medium | 2022-12-12 | $560 | 24 |
| http request smuggling in pscp.tv and periscope.tvAnalysed#713285 | Valid | Injection and Smuggling | High | 2020-09-10 | $560 | 24 |
| CSRF and probable account takeover on https://www.niche.coAnalysed#493535 | Valid | Cross-Site Request Forgery | Medium | 2019-02-28 | – | 24 |
| Open Redirect Protection BypassAnalysed#283460 | Valid | Open Redirect | – | 2017-12-23 | – | 24 |
| File Upload XSS in image uploading of App in mopubAnalysed#97672 | Valid | Cross-site Scripting | – | 2016-08-25 | – | 24 |
| CVE-2017-15277 on Profile pageAnalysed#315906 | Valid | Information Disclosure | Low | 2018-03-08 | – | 23 |
| Twitter for android is exposing user's location to any installed android appAnalysed#185862 | Valid | Information Disclosure | Low | 2017-01-13 | $560 | 23 |
| XSS on OAuth authorize/authenticate endpointAnalysed#87040 | Valid | Cross-site Scripting | – | 2015-11-20 | – | 23 |
| lack of input validation that can lead Denial of Service (DOS)Analysed#768677 | Valid | Denial of Service | Medium | 2020-03-12 | $560 | 22 |
| Unauthorized Access to Protected Tweets via niche.co APIAnalysed#273698 | Valid | Information Disclosure | High | 2017-11-02 | – | 22 |
| Stored XSS in https://app.mopub.comAnalysed#642281 | Valid | Cross-site Scripting | Medium | 2019-12-17 | – | 21 |
| AppLovin API Key hardcoded in a Github repoAnalysed#674774 | Valid | Cryptography | High | 2019-09-18 | $280 | 20 |
| Twitter Source Label allow 'mongolian vowel separator' U+180E (app name)Analysed#785243 | Valid | Input Validation and Logic | Low | 2020-02-21 | – | 19 |
| Improper session handling on web browsersAnalysed#347748 | Valid | Authentication | Medium | 2018-06-26 | $560 | 19 |
| ms5 debug page exposing internal info (internal IPs, headers)Analysed#311326 | Valid | Information Disclosure | Medium | 2018-05-11 | $280 | 19 |
| No Rate Limit in email leads to huge Mass mailingsAnalysed#297359 | Valid | Input Validation and Logic | Low | 2018-06-01 | – | 19 |
| Improper Host Detection During Team Up on tweetdeck.twitter.comAnalysed#294867 | Valid | No weakness recorded | – | 2018-01-04 | – | 19 |
| Sensitive Information Disclosure https://cards-dev.twitter.comAnalysed#268888 | Valid | Information Disclosure | Medium | 2017-09-29 | $280 | 19 |
| [██████████.gnip.com] .htpasswd disclosureAnalysed#219197 | Valid | No weakness recorded | Critical | 2017-05-26 | – | 19 |
| IDOR- Activate Mopub on different organizations- steal api token- Fabric.ioAnalysed#95552 | Valid | Authentication | – | 2016-01-25 | – | 18 |
| iOS app crashed by specially crafted direct message reactionsAnalysed#784676 | Valid | Denial of Service | Medium | 2020-02-21 | $560 | 17 |
| http request smuggling in twitter.com#715996 | Duplicate | Injection and Smuggling | High | 2020-11-18 | – | 17 |
| Protected Tweets setting overridden by Android appAnalysed#519059 | Valid | No weakness recorded | Low | 2019-05-17 | $560 | 17 |
| PI leakage By Brute Forcing and Phone number deleting without using password#1087525 | Duplicate | Access Control | Medium | 2021-04-22 | – | 16 |
| SSRF in https://cards-dev.twitter.com/validatorAnalysed#178184 | Valid | Server-Side Request Forgery | Medium | 2017-04-06 | – | 16 |
| XSS using javascript:alert(8007)Analysed#127154 | Valid | Cross-site Scripting | Low | 2016-11-28 | – | 15 |
| xss in link items (mopub.com)Analysed#100931 | Valid | Cross-site Scripting | – | 2016-07-05 | $560 | 14 |
| User input validation can lead to DOS#767458 | Valid | Denial of Service | Medium | 2020-03-26 | $560 | 13 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.