Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bruteforce password recovery codeAnalysed#743545	Valid	Misconfiguration and Insecure Design	–	2020-01-18	–	258
Leak of authorization urls leads to account takeoverAnalysed#746186	Valid	Misconfiguration and Insecure Design	–	2020-05-08	–	109
The login of Hotor Not is Vulnerable to bruteforce.Analysed#744692	Valid	Authentication	High	2020-01-23	–	59
Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free.Analysed#1037430	Valid	No weakness recorded	Low	2020-12-07	–	57
On Singing up with a Phone number , The 4 digit OTP does not expires for a long time leading to an easy attack and make a verified account easiltyAnalysed#792295	Valid	Misconfiguration and Insecure Design	High	2020-11-25	–	49
Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium serversAnalysed#1034023	Valid	Input Validation and Logic	Medium	2020-12-30	–	40
Identify unique user ID of all the profilesAnalysed#1005020	Valid	Insecure Direct Object Reference	Medium	2020-12-25	–	24
XSS DI BIODATA#949823	Valid	Cross-site Scripting	Medium	2020-11-09	–	–

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.