Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [m.airbnb.com] CRLF InjectionAnalysed#197279 | Valid | Injection and Smuggling | Low | 2018-04-03 | $2,500 | 37 |
| ████ discloses valid Airbnb SSO login names via Google Search ResultsAnalysed#161659 | Valid | Information Disclosure | – | 2016-10-09 | – | 21 |
| I Can Delete Any Airbnb Users Symbol!#49356 | Valid | Authentication | – | 2015-07-03 | – | 5 |
| authenticity_token is not random across page loads#71006 | Valid | Cross-Site Request Forgery | – | 2015-08-12 | – | 4 |
| Vulnerability type xss uncovered in airbnb.es#49513 | Valid | Cross-site Scripting | – | 2015-04-08 | – | 4 |
| SSL Issues#49537 | Valid | Cryptography | – | 2015-04-11 | – | 3 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.