Reflected XSS Analysed #739601 Valid Cross-site Scripting – 2019-11-21 $1,000 317 Exfiltrating a victim's exact location (to within 5m) Analysed #1234406 Valid Information Disclosure – 2021-07-21 – 278 Bruteforce password recovery code Analysed #743545 Valid Misconfiguration and Insecure Design – 2020-01-18 – 258 Leak of authorization urls leads to account takeover #746186 Valid Misconfiguration and Insecure Design – 2020-05-08 – 109 Misconfigured oauth leads to Pre account takeover #1074047 Valid Input Validation and Logic – 2021-03-18 – 90 Bumble API exposes read status of chat messages #1080437 Valid Information Disclosure – 2021-03-13 $600 74 [CRITICAL] Full account takeover using CSRF #127703 Valid Cross-Site Request Forgery – 2016-04-12 – 63 The login of Hotor Not is Vulnerable to bruteforce. #744692 Valid Authentication – 2020-01-23 – 59 Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free. #1037430 Valid No weakness recorded – 2020-12-07 – 57 On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easilty #792295 Valid Misconfiguration and Insecure Design – 2020-11-25 – 49 Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium servers #1034023 Valid Input Validation and Logic – 2020-12-30 – 40 Change contents of the careers iframe in https://corp.badoo.com/jobs #147776 Valid No weakness recorded – 2016-07-07 – 35 Расшифровка всех типов шифрованных ID #402410 Valid Information Disclosure – 2018-11-01 – 32 Compromising the user ID #358007 Valid Information Disclosure – 2018-10-07 – 28 Email Spoofing #182467 Valid Misconfiguration and Insecure Design – 2017-01-24 – 28 Unvalidated redirect on team.badoo.com #177624 Valid Cross-site Scripting – 2016-12-03 $140 25 Identify unique user ID of all the profiles #1005020 Valid Insecure Direct Object Reference – 2020-12-25 – 24 Account Takeover #121827 Valid Cross-Site Request Forgery – 2016-03-12 – 19 crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc. #96662 Valid Misconfiguration and Insecure Design – 2017-08-31 – 16 SSO through odnoklassniki uses http rather than https #703759 Valid Cryptography – 2019-12-21 $150 14 Индексация почты/логинов пользователей #261734 Valid No weakness recorded – 2018-06-24 $140 12 No rate-limit in SERVER_SECURITY_CHECK #174668 Valid Authentication – 2016-11-10 – 11 Leave inaccessible messaging system with a message (https://us1.badoo.com) #178742 Valid No weakness recorded – 2017-01-19 – 10 Arbitrary modification value "session" (Cookie) in badoo.com #178567 Valid No weakness recorded – 2017-06-25 – 9 Open redirect helps to steal Facebook access_token #99435 Valid Open Redirect – 2017-08-31 – 9 Tokens from services like Facebook can be stolen #92472 Valid No weakness recorded – 2016-06-03 – 7 Ability to collect users' ids that have visited a specific web page with malicious code #139192 Valid Information Disclosure – 2016-06-03 – 6 CSRF Attack on (m.badoo.com)deleting account and erasing imported contacts #192131 Valid Cross-Site Request Forgery – 2017-02-06 $280 5 Broken Authentication on Badoo #121469 Valid Authentication – 2016-03-15 $427 5 Получение оригинала скрытого изображения #143669 Valid Information Disclosure – 2016-06-09 $280 3 XSS DI BIODATA #949823 Valid Cross-site Scripting – 2020-11-09 – –