Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Bypass of Cloudflare's Cache Keys and WAF via header overflow#3027461	Valid	Access Control	High	2025-11-18	–	77
Yet Another CASB Integration Takeover of Active IntegrationsAnalysed#2094346	Valid	No weakness recorded	High	2023-11-13	–	68
[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuthAnalysed#3423950	Valid	Cross-site Scripting	High	2026-04-14	–	63
HTTP Request Smuggling via Unsanitized Hop-by-Hop HeadersAnalysed#3622877	Valid	Access Control	High	2026-09-14	$1,500	54
Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seatAnalysed#2122690	Valid	Authentication	High	2023-10-25	–	43
[Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthAnalysed#3321406	Valid	No weakness recorded	High	2026-04-14	–	39
A malicious actor could rotate tokens of a victim, given that he knows the victim's token IDAnalysed#1525309	Valid	Access Control	High	2023-04-13	–	34
Sign in with Apple works on existing accounts, bypasses 2FAAnalysed#1593404	Valid	Authentication	High	2022-06-27	$1,000	32
API docs expose an active token for the sample domain theburritobot.comAnalysed#1507412	Valid	Information Disclosure	High	2022-06-27	$500	28
Completely remove VPN profile from locked WARP iOS cient.Analysed#1633231	Valid	Input Validation and Logic	High	2022-11-07	$1,000	21
I found another way to bypass Cloudflare Warp lock!Analysed#1605847	Valid	Input Validation and Logic	High	2022-11-07	$1,000	20
Ability to bypass locked Cloudflare WARP on wifi networks.#1635748	Valid	Input Validation and Logic	High	2022-11-16	$1,000	12
Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and Bugs#1636320	Valid	Denial of Service	High	2022-09-30	$500	8

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.