Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [m.airbnb.com] CRLF Injection#197279 | Valid | Injection and Smuggling | – | 2018-04-03 | $2,500 | 37 |
| ████ discloses valid Airbnb SSO login names via Google Search Results#161659 | Valid | Information Disclosure | – | 2016-10-09 | – | 21 |
| [airbnb.com] XSS via Cookie flash#197334 | Duplicate | Cross-site Scripting | – | 2018-04-03 | – | 17 |
| Generating Unlimited Free Travel Gift Invites | IDOR#49499 | Informative | Information Disclosure | – | 2015-04-04 | – | 11 |
| I Can Delete Any Airbnb Users Symbol!#49356 | Valid | Authentication | – | 2015-07-03 | – | 5 |
| Call back number not verified#243049 | Informative | Input Validation and Logic | – | 2017-07-20 | – | 4 |
| Nginx Version Disclosure#214570 | Informative | Information Disclosure | – | 2017-03-23 | – | 4 |
| authenticity_token is not random across page loads#71006 | Valid | Cross-Site Request Forgery | – | 2015-08-12 | – | 4 |
| Vulnerability type xss uncovered in airbnb.es#49513 | Valid | Cross-site Scripting | – | 2015-04-08 | – | 4 |
| SSL Issues#49537 | Valid | Cryptography | – | 2015-04-11 | – | 3 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.