Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
AI Playground XSS to steal user-chat messages and access to connected MCP ServerAnalysed#3424998	Valid	Cross-site Scripting	Low	2026-02-26	–	62
Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfigurationAnalysed#1467044	Valid	Server-Side Request Forgery	Low	2022-08-31	–	54
Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATOAnalysed#3316910	Valid	Cross-site Scripting	Low	2025-12-16	–	50
Bypass two-factor authenticationAnalysed#1664974	Valid	Authentication	Low	2022-10-04	$250	34
💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥Analysed#1781096	Valid	Memory Corruption	Low	2023-07-31	–	29
YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com#2174818	Informative	Injection and Smuggling	Low	2023-11-10	–	24
cd=false (DNSSEC) not respected in DNS over HTTPS JSON requestsAnalysed#1724464	Valid	Input Validation and Logic	Low	2022-12-12	$250	23
Bypassing creation of API tokens without email verificationAnalysed#1812705	Valid	Authentication	Low	2023-03-27	–	19
Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accountsAnalysed#1593413	Valid	Authentication	Low	2022-06-27	$250	17
Misconfigured build on websites "abuse.cloudflare.com"#1624911	Valid	No weakness recorded	Low	2022-10-13	$100	12
Password Policy Restriction Bypass#1675730	Valid	Misconfiguration and Insecure Design	Low	2022-09-30	–	11
Privilege escalation to root in Pages build image v2#1979372	Valid	Access Control	Low	2023-05-26	$350	10

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.