Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Uber password reset link EMAIL FLOOD#126364 | Duplicate | Denial of Service | – | 2016-06-13 | – | 3 |
| CRLF Injection in developer.uber.com#125984 | Duplicate | No weakness recorded | – | 2016-05-09 | – | 3 |
| CSRF on eng.uber.com may lead to server-side compromise#125594 | Valid | Cross-Site Request Forgery | – | 2016-04-26 | – | 3 |
| Create account in uber without signup form#125242 | Informative | Authentication | – | 2016-06-13 | – | 3 |
| HTML Escaping Error in the 404 Page on developer.uber.com/docs/#125130 | Valid | Cross-site Scripting | – | 2016-04-06 | – | 3 |
| Unauthorized file (invoice) download#115209 | Duplicate | Authentication | – | 2016-06-15 | – | 3 |
| User Enumeration and Information Disclosure#155578 | Informative | Information Disclosure | – | 2016-08-12 | – | 2 |
| faspex.uber.com uses an invalid SSL certificate#146847 | Informative | Cryptography | – | 2016-07-07 | – | 2 |
| Server version disclosure: team.uberinternal.com#146327 | Informative | Information Disclosure | – | 2016-07-07 | – | 2 |
| User credentials are not strong on vault.uber.com#128895 | Duplicate | Authentication | – | 2016-07-26 | – | 2 |
| Information disclosure at lite.uber.com#128853 | Informative | Information Disclosure | – | 2016-06-13 | – | 2 |
| Enumerating userIDs with phone numbers#128723 | Duplicate | Information Disclosure | – | 2016-06-11 | – | 2 |
| Session Impersonation in riders.uber.com#127645 | Informative | Authentication | – | 2016-06-13 | – | 2 |
| It is possible to re-rate a driver after a very long time#126835 | Informative | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 2 |
| Pixel flood attack in https://riders.uber.com/profile#126826 | Informative | Denial of Service | – | 2016-04-25 | – | 2 |
| Disclosure of ip addresses in local network of uber#126569 | Informative | Information Disclosure | – | 2016-06-13 | – | 2 |
| Session retention is present which reveals the customer info#125634 | Duplicate | Authentication | – | 2016-05-09 | – | 2 |
| Estimation of a Lower Bound on Number of Uber Drivers via Enumeration#125488 | Valid | Information Disclosure | – | 2016-08-24 | $500 | 2 |
| Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/#124975 | Informative | Cross-site Scripting | – | 2016-03-24 | – | 2 |
| Active Email Hyperlink Sent on riders.uber.com#122791 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 2 |
| Design Issue at riders.uber.com/profile#298888 | Informative | Input Validation and Logic | None | 2017-12-28 | – | 1 |
| Command Injection, Information#146735 | Informative | Command and Code Injection | – | 2016-07-07 | – | 1 |
| Error Message on 404 page#145893 | Informative | No weakness recorded | – | 2016-07-07 | – | 1 |
| Self-XSS in Partners Profile#145289 | Duplicate | Cross-site Scripting | – | 2016-07-07 | – | 1 |
| DOM based XSS on#139875 | Informative | Command and Code Injection | – | 2016-05-26 | – | 1 |
| Clickjacking in love.uber.com#137152 | Informative | Misconfiguration and Insecure Design | – | 2016-07-07 | – | 1 |
| Stored self-XSS at m.uber.com#134124 | Valid | Cross-site Scripting | – | 2016-07-08 | – | 1 |
| CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```#131560 | Duplicate | No weakness recorded | – | 2016-05-09 | – | 1 |
| developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes#130136 | Informative | No weakness recorded | – | 2016-06-13 | – | 1 |
| Easy spam with USE My PHONE Feature#127918 | Valid | Memory Corruption | – | 2016-06-13 | $250 | 1 |
| Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers#127025 | Informative | Information Disclosure | – | 2016-06-13 | – | 1 |
| SMS Flood with Update Profile#126536 | Duplicate | Denial of Service | – | 2016-06-13 | – | 1 |
| Changing Driver Passwords With Only an Authenticated Session (no password, no email)#126377 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 1 |
| Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload Page#126374 | Informative | Misconfiguration and Insecure Design | – | 2016-06-13 | – | 1 |
| Privilege escalation to allow non activated users to login and use uber partner ios app#126260 | N/A | Access Control | – | 2016-06-13 | – | 1 |
| XSS In archive.uber.com Due to Mime Sniffing in IE#126197 | Valid | Cross-site Scripting | – | 2016-04-06 | $750 | 1 |
| Cross-site Scripting (XSS)#126049 | Valid | Cross-site Scripting | – | 2016-05-06 | – | 1 |
| Brute Force Amplification Attack#125624 | Informative | Misconfiguration and Insecure Design | – | 2016-08-12 | – | 1 |
| XSS on love.uber.com#125179 | Duplicate | Cross-site Scripting | – | 2016-05-09 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.