Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
80 of 15,219 reports · $18,100 in bounties · 161 analysed so far
- #307239ValidAnalysedDouble Payout via PayPalCoinbase · Input Validation and Logic · 2018 · needs: a user account · Business logic flaw, Race condition$10,000324votes
- #300748ValidEthereum account balance manipulationCoinbase · Input Validation and Logic · 2018–276votes
- #328526ValidETH contract handling errorsCoinbase · Input Validation and Logic · 2018–208votes
- #104543ValidHTML injection in apps user reviewCoinbase · No weakness recorded · 2015$20031votes
- #176979ValidAuthentication IssueCoinbase · Access Control · 2017$20027votes
- #218680Valid[buy.coinbase.com]Content InjectionCoinbase · No weakness recorded · 2017–26votes
- #246801ValidCaptcha Bypass in Coinbase SignUp FormCoinbase · Misconfiguration and Insecure Design · 2017$10023votes
- #10554ValidBypassing 2FA for BTC transfersCoinbase · Authentication · 2014$1,00018votes
- #316290ValidPrepopulation of email address and name leaks information provided to other merchantsCoinbase · Misconfiguration and Insecure Design · 2018–16votes
- #65825ValidOAuth authorization page vulnerable to clickjackingCoinbase · Authentication · 2016–16votes
- #315865ValidStored CSS InjectionCoinbase · Injection and Smuggling · 2018–15votes
- #118631ValidXSSI (Cross Site Script Inclusion)Coinbase · Cross-Site Request Forgery · 2017–15votes
- #5314ValidCoinbase Android Application - Bitcoin Wallet Leaks OAuth Response CodeCoinbase · Information Disclosure · 2014–14votes
- #202361InformativeRequestor Email Disclosure via Email NotificationCoinbase · Information Disclosure · 2017–13votes
- #100829ValidStored-XSS in https://www.coinbase.com/Coinbase · Cross-site Scripting · 2015–13votes
- #147577ValidApplication error messageCoinbase · Information Disclosure · 2016$10012votes
- #53004ValidBlacklist bypass on Callback URLsCoinbase · Information Disclosure · 2016$10012votes
- #126376ValidEmail leak in transcations in Android appCoinbase · Misconfiguration and Insecure Design · 2016$50011votes
- #112496ValidSession Issue Maybe Can lead to huge loss [CRITICAL]Coinbase · Cryptography · 2016$1,00010votes
- #5786InformativeCoinbase Android Security VulnerabilitiesCoinbase · Cryptography · 2014–9votes
- #106360ValidRace condition allowing user to review app multiple timesCoinbase · No weakness recorded · 2016–8votes
- #100186ValidTransactions visible on Unconfirmed devicesCoinbase · Authentication · 2015$5008votes
- #248599ValidInformation disclosure same issue #176002Coinbase · No weakness recorded · 2017$1007votes
- #168509ValidInformation leakage on https://docs.gdax.comCoinbase · Information Disclosure · 2016$1007votes
- #148538DuplicateNo authorization required in iOS device web-applicationCoinbase · Authentication · 2016–7votes
- #57764ValidByPassing the email Validation Email on Sign up process in mobile appsCoinbase · Misconfiguration and Insecure Design · 2016$1007votes
- #15412ValidLeaking CSRF token over HTTP resulting in CSRF protection bypassCoinbase · Cross-Site Request Forgery · 2014$1,0007votes
- #176002ValidInformation disclosure of user by email using buy widgetCoinbase · Information Disclosure · 2016–6votes
- #168289Informativecoinbase Email leak while sending and requestingCoinbase · Authentication · 2016–6votes
- #148952InformativeContent Injection error pageCoinbase · Misconfiguration and Insecure Design · 2017–6votes
- #90308ValidUser email enumuration using GmailCoinbase · Information Disclosure · 2015–6votes
- #160498Validwindow.opener is leaking to external domains upon redirect on SafariCoinbase · Misconfiguration and Insecure Design · 2016–5votes
- #155726N/ACreate Multiple Account Using Similar X-CSRF tokenCoinbase · Misconfiguration and Insecure Design · 2016–5votes
- #148537DuplicateNo authorization required in Windows phone web-applicationCoinbase · Authentication · 2016–5votes
- #87561ValidOAUTH pemission set as true= lead to authorize malicious applicationCoinbase · Authentication · 2015$1005votes
- #66223InformativeTwo-factor authentication (via SMS)Coinbase · Authentication · 2015–5votes
- #30238ValidNew Device confirmation tokens are not properly validated.Coinbase · Authentication · 2015$1005votes
- #16696Informative2FA settings allowed to be changed with no delay/freeze on fundsCoinbase · Misconfiguration and Insecure Design · 2014–5votes
- #119605N/AAn adversary can overwhelm the resources by automating Forgot password/Sign Up requestsCoinbase · Authentication · 2016–4votes
- #109810N/AThe 'Create a New Account' action is vulnerable to CSRFCoinbase · Cross-Site Request Forgery · 2016–4votes
- #48065Validopen authentication bugCoinbase · Authentication · 2015–4votes
- #11722InformativeSimultaneous Session Logon : Improper Session ManagementCoinbase · Authentication · 2014–4votes
- #5200InformativeUser Enumeration, Information Disclosure and Lack of Rate Limitation on APICoinbase · Misconfiguration and Insecure Design · 2014–4votes
- #231760N/AOpen redirect on sign inCoinbase · Open Redirect · 2017–3votes
- #126784ValidSending payments via QR code does not require confirmationCoinbase · Authentication · 2016$1,0003votes
- #104620InformativeXXE in OAuth2 Applications gallery profile App logoCoinbase · No weakness recorded · 2015–3votes
- #54733ValidSandboxed iframes don't show confirmation screenCoinbase · Misconfiguration and Insecure Design · 2015–3votes
- #36594ValidNew Device Confirmation, token is valid until not used.Coinbase · Cryptography · 2015–3votes
- #21034ValidInvoice Details activate JS that filled inCoinbase · Cross-site Scripting · 2015–3votes
- #10563ValidCSRF on "Set as primary" option on the accounts pageCoinbase · Cross-Site Request Forgery · 2014$1003votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.