Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Cloudflare CASB Confused Deputy ProblemAnalysed#1952124	Valid	No weakness recorded	Critical	2023-06-07	$3,300	97
Using special IPv4-mapped IPv6 addresses to bypass local IP banAnalysed#1785260	Valid	No weakness recorded	Critical	2023-01-24	$7,500	78
Yet Another CASB Integration Takeover of Active IntegrationsAnalysed#2094346	Valid	No weakness recorded	High	2023-11-13	–	68
Bypass R2 payment screenAnalysed#2170559	Valid	Authentication	Medium	2023-11-10	$350	57
Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seatAnalysed#2122690	Valid	Authentication	High	2023-10-25	–	43
A malicious actor could rotate tokens of a victim, given that he knows the victim's token IDAnalysed#1525309	Valid	Access Control	High	2023-04-13	–	34
💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥Analysed#1781096	Valid	Memory Corruption	Low	2023-07-31	–	29
Basic XSS [WAF Bypasses]#1615743	Informative	No weakness recorded	–	2023-07-07	$50	27
YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com#2174818	Informative	Injection and Smuggling	Low	2023-11-10	–	24
Cloudflare is not properly deleting user's accountAnalysed#1728292	Valid	Input Validation and Logic	Medium	2023-04-13	–	23
Origin IP address disclosure through Pingora response headerAnalysed#1803659	Valid	Information Disclosure	Medium	2023-01-10	–	21
Bypassing creation of API tokens without email verificationAnalysed#1812705	Valid	Authentication	Low	2023-03-27	–	19
Session mismatch leading to potential account takeover (local access required)#1825227	Valid	Insecure Direct Object Reference	Medium	2023-04-10	–	16
Extraction of Pages build scripts, config values, tokens, etc. via symlinksAnalysed#1754811	Valid	Information Disclosure	Medium	2023-03-06	$500	12
Privilege escalation to root in Pages build image v2#1979372	Valid	Access Control	Low	2023-05-26	$350	10

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.